Mevade.A
Posted: September 18, 2013
Threat Metric
The following fields listed on the Threat Meter containing a specific value, are explained in detail below:
Threat Level: The threat level scale goes from 1 to 10 where 10 is the highest level of severity and 1 is the lowest level of severity. Each specific level is relative to the threat's consistent assessed behaviors collected from SpyHunter's risk assessment model.
Detection Count: The collective number of confirmed and suspected cases of a particular malware threat. The detection count is calculated from infected PCs retrieved from diagnostic and scan log reports generated by SpyHunter.
Volume Count: Similar to the detection count, the Volume Count is specifically based on the number of confirmed and suspected threats infecting systems on a daily basis. High volume counts usually represent a popular threat but may or may not have infected a large number of systems. High detection count threats could lay dormant and have a low volume count. Criteria for Volume Count is relative to a daily detection count.
Trend Path: The Trend Path, utilizing an up arrow, down arrow or equal symbol, represents the level of recent movement of a particular threat. Up arrows represent an increase, down arrows represent a decline and the equal symbol represent no change to a threat's recent movement.
% Impact (Last 7 Days): This demonstrates a 7-day period change in the frequency of a malware threat infecting PCs. The percentage impact correlates directly to the current Trend Path to determine a rise or decline in the percentage.
| Threat Level: | 6/10 |
|---|---|
| Infected PCs: | 47 |
| First Seen: | September 18, 2013 |
|---|---|
| OS(es) Affected: | Windows |
Mevade.A is one of the newest variants of the Mevade backdoor Trojan, which is estimated to have a lifespan extending as far back as four years ago. Although, by the standards of malware, Mevade.A is a fairly old PC threat, SpywareRemove.com malware researchers and others within the industry have noticed signs of Mevade.A's campaign experiencing a resurgence and a significant restructuring that could enable Mevade.A to initiate new attacks against hundreds or thousands of PCs compromised through its Tor-based backdoor connection. The standard symptoms of a Mevade.A infection usually include browser hijacks and/or adware attacks, but these symptoms may not be seen in all cases of a Mevade.A infection, and removing Mevade.A always should be treated as a job for the most advanced anti-malware programs that are available.
Mevade.A: the New Wave of Cybercrime, Hidden in Anonymity
Mevade.A is a relatively generalized backdoor Trojan that's capable of installing many separate PC threats, with different installations having the potential to differ significantly from one another. Previous attacks related to Mevade.A Trojans usually involved adware, browser hijackers or Potentially Unwanted Programs that modified your browser to redirect to unwanted sites or display advertisements – both of which are easy ways for criminals to monetize an infected computer with very little risk. However, Mevade.A also can install many other types of threats, including spyware, worms or banking Trojans that have the capacity for direct attempts to steal personal information or otherwise harm the PC user in more serious ways than launching a few advertisement pop-ups.
Mevade.A has received particular media attention lately for recent changes to its attack campaign to use an outdated version of the Tor Network's anonymity service. Tor previously has been used by other types of Trojans, such as Atrax or Tor Malware, and sometimes is exploited by criminals during serious attempts to compromise financial or identity-related information. At this time, SpywareRemove.com malware experts have found that Japanese and American-based PCs are most probably in danger of a potential Mevade.A attack, but these attacks also have been observed in many other countries around the globe.
Barricading the Trojan that Wants to Rise Above Your PC's Security
Because Mevade.A's family is well-associated with fraudulent Flash updates as its favorite infection vectors, paying attention to where you get your updates from is one of the simplest defenses against Mevade.A and other variants of Mevade. These very same types of attacks also have been used by many other low and high-level PC threats that SpywareRemove.com malware analysts have examined in previous times such as Trojan.FakeFlash, Trojan.Win32.Kryptik.ake and many types of Police Ransomware Trojans. Most anti-malware products should be able to detect and remove Mevade.A before Mevade.A is installed – provided that you're running anti-malware software while browsing the Web.
Mevade.A often may change your search results or display advertisements, but these attacks are (as mentioned earlier) not hard-coded into all general Mevade.A attacks. Mevade.A, like many backdoor Trojans, does not necessarily have to display any symptoms at all even while Mevade.A indulges in attacks that may compromise your bank account or cause other security issues with long term consequences for your PC.
Technical Details
File System Modifications
Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.
The following files were created in the system:%System%\config\systemprofile\Local Settings\Application Data\Windows Internet Name Service\049e7fb749be2cdf169e28bb0a27254f\181084e525a65ef540c63d60ce07f836.ph
File name: %System%\config\systemprofile\Local Settings\Application Data\Windows Internet Name Service\049e7fb749be2cdf169e28bb0a27254f\181084e525a65ef540c63d60ce07f836.phMime Type: unknown/ph
Group: Malware file
%System%\config\systemprofile\Local Settings\Application Data\Windows Internet Name Service\049e7fb749be2cdf169e28bb0a27254f\181084e525a65ef540c63d60ce07f836.ct
File name: %System%\config\systemprofile\Local Settings\Application Data\Windows Internet Name Service\049e7fb749be2cdf169e28bb0a27254f\181084e525a65ef540c63d60ce07f836.ctMime Type: unknown/ct
Group: Malware file
%ProgramFiles%\Tor\tor.exe
File name: %ProgramFiles%\Tor\tor.exeFile type: Executable File
Mime Type: unknown/exe
Group: Malware file
%System%\config\systemprofile\Local Settings\Application Data\Windows Internet Name Service\queries-02.cache
File name: %System%\config\systemprofile\Local Settings\Application Data\Windows Internet Name Service\queries-02.cacheMime Type: unknown/cache
Group: Malware file
%System%\config\systemprofile\Local Settings\Application Data\Windows Internet Name Service\cache.00
File name: %System%\config\systemprofile\Local Settings\Application Data\Windows Internet Name Service\cache.00Mime Type: unknown/00
Group: Malware file
%SystemDrive%\Documents and Settings\LocalService\Application Data\tor\state
File name: %SystemDrive%\Documents and Settings\LocalService\Application Data\tor\stateGroup: Malware file
%SystemDrive%\Documents and Settings\LocalService\Application Data\tor\lock
File name: %SystemDrive%\Documents and Settings\LocalService\Application Data\tor\lockGroup: Malware file
Registry Modifications
HKEY..\..\{CLSID Path}HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_WINDOWS_INTERNET_NAME_SERVICE\0000\"ClassGUID" = "{8ECC055D-047F-11D1-A537-0000F8753ED1}"HKEY..\..\{Value}HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Windows Internet Name Service\"ErrorControl" = "1"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Windows Internet Name Service\"FailureActions" = "[BINARY DATA]"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Windows Internet Name Service\"Description" = "Provides Internet Name Service"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Windows Internet Name Service\"DisplayName" = "Windows Internet Name Service"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Windows Internet Name Service\"Group" = "netsvcs"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Windows Internet Name Service\"ImagePath" = "%System%\config\systemprofile\Local Settings\Application Data\Windows Internet Name Service\wins.exe"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Windows Internet Name Service\"Type" = "16"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Windows Internet Name Service\Security\"Security" = "[BINARY DATA]"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Windows Internet Name Service\"ObjectName" = "LocalSystem"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Windows Internet Name Service\"Start" = "2"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tor\"ErrorControl" = "0"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tor\"ImagePath" = ""%ProgramFiles%\Tor\tor.exe\" --nt-service \"-ControlPort\" \"9051""HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tor\"Description" = "Provides an anonymous Internet communication system"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tor\"DisplayName" = "Tor Win32 Service"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tor\"ObjectName" = "NT AUTHORITY\LocalService"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tor\Security\"Security" = "[BINARY DATA]" HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_TOR\"NextInstance" = "1"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tor\"Start" = "2"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tor\"Type" = "16"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_TOR\0000\"ConfigFlags" = "0"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_TOR\0000\"DeviceDesc" = "Tor Win32 Service"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_TOR\0000\"Class" = "LegacyDriver"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_TOR\0000\"ClassGUID" = "{8ECC055D-047F-11D1-A537-0000F8753ED1}"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_TOR\0000\"Legacy" = "1"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_TOR\0000\"Service" = "tor"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_WINDOWS_INTERNET_NAME_SERVICE\0000\"ConfigFlags" = "0"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_WINDOWS_INTERNET_NAME_SERVICE\"NextInstance" = "1"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_WINDOWS_INTERNET_NAME_SERVICE\0000\"Class" = "LegacyDriver"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_WINDOWS_INTERNET_NAME_SERVICE\0000\"Service" = "Windows Internet Name Service" HKEY_LOCAL_MACHINE\SECURITY\Policy\Secrets\_SC_tor\"(Default)" = "4"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_WINDOWS_INTERNET_NAME_SERVICE\0000\"DeviceDesc" = "Windows Internet Name Service"HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\"Local AppData" = "%SystemDrive%\Documents and Settings\LocalService\Local Settings\Application Data"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_WINDOWS_INTERNET_NAME_SERVICE\0000\"Legacy" = "1"HKEY_LOCAL_MACHINE\SECURITY\Policy\Secrets\_SC_tor\SecDesc\"(Default)" = "[BINARY DATA]"
Leave a Reply
Please note that we are not able to assist with billing and support issues regarding SpyHunter or other products. If you're having issues with SpyHunter, please get in touch with SpyHunter customer support through your SpyHunter . If you have SpyHunter billing questions, we recommend you check the Billing FAQ. For general suggestions or feedback, contact us.