Home Malware Programs Trojans PWS:Win32/Simda.AF

PWS:Win32/Simda.AF

Posted: November 21, 2012

Threat Metric

Threat Level: 9/10
Infected PCs: 19
First Seen: November 21, 2012
Last Seen: September 21, 2020
OS(es) Affected: Windows

PWS:Win32/Simda.AF is a password-stealing Trojan that may also allow attackers to gain backdoor access and control of the affected computer. The main purpose of PWS:Win32/Simda.AF is to steal passwords and system information from the affected computer. Once installed, PWS:Win32/Simda.AF modifies the Windows Registry. When activated, PWS:Win32/Simda.AF copies itself with random file name to the "%windir%\AppPatch" folder. PWS:Win32/Simda.AF creates the certain registry entries so that its copy can run automatically every time Windows is started. PWS:Win32/Simda.AF strives to connect to certain servers to wait for instructions. PWS:Win32/Simda.AF sends the stolen information to a remote server. PWS:Win32/Simda.AF block PC users from accessing certain websites. PWS:Win32/Simda.AF checks the URL of websites the PC user visits if they include any of the certain strings. If PWS:Win32/Simda.AF finds that the PC is visiting websites that include any of these strings, it may reroute the victim to Google. Once loaded, PWS:Win32/Simda.AF strives to insert itself into the legitimate processes if they are running on the compromised PC. Depending on the process, PWS:Win32/Simda.AF inserts itself either as part of its information stealing process, to remain resident in memory, or to disguise itself from other processes.

Technical Details

Registry Modifications

The following newly produced Registry Values are:

HKEY..\..\{Value}HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon "userinit" = "c:\windows\system32\userinit.exe,%windir%\AppPatch\[RANDOM NAME].exe,"HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run "userinit" = "%windir%\AppPatch\[RANDOM NAME].exe"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon load" = "%windir%\AppPatch\[RANDOM NAME].exe"HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows "System" = "%windir%\AppPatch\[RANDOM NAME].exe"HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows "run" = "%windir%\AppPatch\[RANDOM NAME].exe"HKEY..\..\..\..{Subkeys}HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows "run"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "userinit"HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows "System"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon "load"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon "userinit"
Loading...