Home Malware Programs Trojans Trojan.Ranbot

Trojan.Ranbot

Posted: December 23, 2012

Threat Metric

Threat Level: 8/10
Infected PCs: 49
First Seen: December 23, 2012
OS(es) Affected: Windows

Trojan.Ranbot is a Trojan that opens a back door and steals information from the affected computer user. Trojan.Ranbot targets Alfa-Bank. Once executed, Trojan.Ranbot creates potentially malicious files on the infected computer system. Trojan.Ranbot creates a certain registry entry to insert itself into the 'svchost.exe' process and add a firewall policy exception. Trojan.Ranbot also creates a registry entry so that it can run every time you start Windows. Trojan.Ranbot also makes other Windows Registry modifications. Trojan.Ranbot may insert itself into the targeted web browser to monitor Internet traffic and collect banking information. Trojan.Ranbot attempts to connect to certain domains.

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:



%System%\[RANDOM CHARACTERS].exe File name: %System%\[RANDOM CHARACTERS].exe
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
%Temp%\RGI1.tmp File name: %Temp%\RGI1.tmp
File type: Temporary File
Mime Type: unknown/tmp
Group: Malware file

Registry Modifications

The following newly produced Registry Values are:

HKEY..\..\{Value}HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\"%System%\svchost.exe" = "%System%\svchost.exe:*:Enabled:\[RANDOM CHARACTERS]"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\"DefaultConnectionSettings" = "[BINARY DATA]"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\..{RunKeys}HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\"[RANDOM CHARACTERS]" = "%System%\[RANDOM CHARACTERS].exe"
Loading...