Home Malware Programs Trojans Mevade.A

Mevade.A

Posted: September 18, 2013

Threat Metric

Threat Level: 6/10
Infected PCs: 47
First Seen: September 18, 2013
OS(es) Affected: Windows

Mevade.A is one of the newest variants of the Mevade backdoor Trojan, which is estimated to have a lifespan extending as far back as four years ago. Although, by the standards of malware, Mevade.A is a fairly old PC threat, SpywareRemove.com malware researchers and others within the industry have noticed signs of Mevade.A's campaign experiencing a resurgence and a significant restructuring that could enable Mevade.A to initiate new attacks against hundreds or thousands of PCs compromised through its Tor-based backdoor connection. The standard symptoms of a Mevade.A infection usually include browser hijacks and/or adware attacks, but these symptoms may not be seen in all cases of a Mevade.A infection, and removing Mevade.A always should be treated as a job for the most advanced anti-malware programs that are available.

Mevade.A: the New Wave of Cybercrime, Hidden in Anonymity

Mevade.A is a relatively generalized backdoor Trojan that's capable of installing many separate PC threats, with different installations having the potential to differ significantly from one another. Previous attacks related to Mevade.A Trojans usually involved adware, browser hijackers or Potentially Unwanted Programs that modified your browser to redirect to unwanted sites or display advertisements – both of which are easy ways for criminals to monetize an infected computer with very little risk. However, Mevade.A also can install many other types of threats, including spyware, worms or banking Trojans that have the capacity for direct attempts to steal personal information or otherwise harm the PC user in more serious ways than launching a few advertisement pop-ups.

Mevade.A has received particular media attention lately for recent changes to its attack campaign to use an outdated version of the Tor Network's anonymity service. Tor previously has been used by other types of Trojans, such as Atrax or Tor Malware, and sometimes is exploited by criminals during serious attempts to compromise financial or identity-related information. At this time, SpywareRemove.com malware experts have found that Japanese and American-based PCs are most probably in danger of a potential Mevade.A attack, but these attacks also have been observed in many other countries around the globe.

Barricading the Trojan that Wants to Rise Above Your PC's Security

Because Mevade.A's family is well-associated with fraudulent Flash updates as its favorite infection vectors, paying attention to where you get your updates from is one of the simplest defenses against Mevade.A and other variants of Mevade. These very same types of attacks also have been used by many other low and high-level PC threats that SpywareRemove.com malware analysts have examined in previous times such as Trojan.FakeFlash, Trojan.Win32.Kryptik.ake and many types of Police Ransomware Trojans. Most anti-malware products should be able to detect and remove Mevade.A before Mevade.A is installed – provided that you're running anti-malware software while browsing the Web.

Mevade.A often may change your search results or display advertisements, but these attacks are (as mentioned earlier) not hard-coded into all general Mevade.A attacks. Mevade.A, like many backdoor Trojans, does not necessarily have to display any symptoms at all even while Mevade.A indulges in attacks that may compromise your bank account or cause other security issues with long term consequences for your PC.

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:



%System%\config\systemprofile\Local Settings\Application Data\Windows Internet Name Service\049e7fb749be2cdf169e28bb0a27254f\181084e525a65ef540c63d60ce07f836.ph File name: %System%\config\systemprofile\Local Settings\Application Data\Windows Internet Name Service\049e7fb749be2cdf169e28bb0a27254f\181084e525a65ef540c63d60ce07f836.ph
Mime Type: unknown/ph
Group: Malware file
%System%\config\systemprofile\Local Settings\Application Data\Windows Internet Name Service\049e7fb749be2cdf169e28bb0a27254f\181084e525a65ef540c63d60ce07f836.ct File name: %System%\config\systemprofile\Local Settings\Application Data\Windows Internet Name Service\049e7fb749be2cdf169e28bb0a27254f\181084e525a65ef540c63d60ce07f836.ct
Mime Type: unknown/ct
Group: Malware file
%ProgramFiles%\Tor\tor.exe File name: %ProgramFiles%\Tor\tor.exe
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
%System%\config\systemprofile\Local Settings\Application Data\Windows Internet Name Service\queries-02.cache File name: %System%\config\systemprofile\Local Settings\Application Data\Windows Internet Name Service\queries-02.cache
Mime Type: unknown/cache
Group: Malware file
%System%\config\systemprofile\Local Settings\Application Data\Windows Internet Name Service\cache.00 File name: %System%\config\systemprofile\Local Settings\Application Data\Windows Internet Name Service\cache.00
Mime Type: unknown/00
Group: Malware file
%SystemDrive%\Documents and Settings\LocalService\Application Data\tor\state File name: %SystemDrive%\Documents and Settings\LocalService\Application Data\tor\state
Group: Malware file
%SystemDrive%\Documents and Settings\LocalService\Application Data\tor\lock File name: %SystemDrive%\Documents and Settings\LocalService\Application Data\tor\lock
Group: Malware file

Registry Modifications

The following newly produced Registry Values are:

HKEY..\..\{CLSID Path}HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_WINDOWS_INTERNET_NAME_SERVICE\0000\"ClassGUID" = "{8ECC055D-047F-11D1-A537-0000F8753ED1}"HKEY..\..\{Value}HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Windows Internet Name Service\"ErrorControl" = "1"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Windows Internet Name Service\"FailureActions" = "[BINARY DATA]"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Windows Internet Name Service\"Description" = "Provides Internet Name Service"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Windows Internet Name Service\"DisplayName" = "Windows Internet Name Service"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Windows Internet Name Service\"Group" = "netsvcs"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Windows Internet Name Service\"ImagePath" = "%System%\config\systemprofile\Local Settings\Application Data\Windows Internet Name Service\wins.exe"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Windows Internet Name Service\"Type" = "16"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Windows Internet Name Service\Security\"Security" = "[BINARY DATA]"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Windows Internet Name Service\"ObjectName" = "LocalSystem"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Windows Internet Name Service\"Start" = "2"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tor\"ErrorControl" = "0"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tor\"ImagePath" = ""%ProgramFiles%\Tor\tor.exe\" --nt-service \"-ControlPort\" \"9051""HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tor\"Description" = "Provides an anonymous Internet communication system"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tor\"DisplayName" = "Tor Win32 Service"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tor\"ObjectName" = "NT AUTHORITY\LocalService"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tor\Security\"Security" = "[BINARY DATA]" HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_TOR\"NextInstance" = "1"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tor\"Start" = "2"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tor\"Type" = "16"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_TOR\0000\"ConfigFlags" = "0"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_TOR\0000\"DeviceDesc" = "Tor Win32 Service"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_TOR\0000\"Class" = "LegacyDriver"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_TOR\0000\"ClassGUID" = "{8ECC055D-047F-11D1-A537-0000F8753ED1}"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_TOR\0000\"Legacy" = "1"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_TOR\0000\"Service" = "tor"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_WINDOWS_INTERNET_NAME_SERVICE\0000\"ConfigFlags" = "0"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_WINDOWS_INTERNET_NAME_SERVICE\"NextInstance" = "1"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_WINDOWS_INTERNET_NAME_SERVICE\0000\"Class" = "LegacyDriver"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_WINDOWS_INTERNET_NAME_SERVICE\0000\"Service" = "Windows Internet Name Service" HKEY_LOCAL_MACHINE\SECURITY\Policy\Secrets\_SC_tor\"(Default)" = "4"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_WINDOWS_INTERNET_NAME_SERVICE\0000\"DeviceDesc" = "Windows Internet Name Service"HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\"Local AppData" = "%SystemDrive%\Documents and Settings\LocalService\Local Settings\Application Data"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_WINDOWS_INTERNET_NAME_SERVICE\0000\"Legacy" = "1"HKEY_LOCAL_MACHINE\SECURITY\Policy\Secrets\_SC_tor\SecDesc\"(Default)" = "[BINARY DATA]"
Loading...