Home Malware Programs Trojans Trojan.Reveton.C

Trojan.Reveton.C

Posted: September 10, 2012

Threat Metric

Threat Level: 8/10
Infected PCs: 213
First Seen: September 10, 2012
Last Seen: April 12, 2022
OS(es) Affected: Windows

Trojan.Reveton.C is a Trojan that changes the web browser settings in order to connect to remote servers. Trojan.Reveton.C is installed on the compromised PC without the PC user's permission and knowledge. Trojan.Reveton.C targets all web browsers by injecting a malicious code into legitimate process files such as firefox.exe, iexplore.exe, chrome.exe, and opera.exe and successfully compromising them in order to evade detection and removal of anti-virus software from the PC. Trojan.Reveton.C creates the copy of itself as a shortcut fileTrojan.Reveton.C modifies the Windows Registry to disable the 'Protected mode is currently turned off for the Internet zone' message that is shown in Internet Explorer. Also, Trojan.Reveton.C locks the toolbar of Internet Explorer to block the user from undoing the changes. Trojan.Reveton.C connects to the certain IPs and domains and contacts the remote servers to execute it's payload. Once the connection is created, Trojan.Reveton.C affirms Internet connectivity and informs attackers that another computer has been hacked. Trojan.Reveton.C gets configuration data and fulfills a variety of malicious actions.

Aliases

Generic29.AWET [AVG]TR/Reveton.C.75 [AntiVir]Trojan-Ransom.Win32.Foreign.qki [Kaspersky]Generic29.BDKN [AVG]W32/Foreign.QLX!tr [Fortinet]TR/Reveton.C.87 [AntiVir]Trojan-Ransom.Win32.Foreign.qlx [Kaspersky]TrojanRansom.Foreign.qlx [CAT-QuickHeal]Generic29.AUSG [AVG]Trojan/Win32.Swisyn [AhnLab-V3]TR/Reveton.C.74 [AntiVir]Trojan-Ransom.Win32.Foreign.qkh [Kaspersky]Win32:Reveton-DX [Trj] [Avast]TrojanRansom.Foreign.qkh [CAT-QuickHeal]Ransomer.AHZ [AVG]
More aliases (208)

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:



%USERPROFILE%\Local Settings\Application Data\mvy.exe File name: mvy.exe
Size: 308.22 KB (308224 bytes)
MD5: cf09f2bc5e3969fe1e59e49117723006
Detection count: 92
File type: Executable File
Mime Type: unknown/exe
Path: %USERPROFILE%\Local Settings\Application Data
Group: Malware file
Last Updated: September 14, 2012
%SystemDrive%\Users\<username>\AppData\Local\Temp\0_0u_l.exe File name: 0_0u_l.exe
Size: 179.87 KB (179872 bytes)
MD5: d424d30099bd740f347e00a992cd5c11
Detection count: 92
File type: Executable File
Mime Type: unknown/exe
Path: %SystemDrive%\Users\<username>\AppData\Local\Temp
Group: Malware file
Last Updated: September 11, 2012
%SystemDrive%\Users\<username>\AppData\Local\Temp\install_0_msi.exe File name: install_0_msi.exe
Size: 121.85 KB (121856 bytes)
MD5: 46efbb67ea55670baf846b56502ab87e
Detection count: 69
File type: Executable File
Mime Type: unknown/exe
Path: %SystemDrive%\Users\<username>\AppData\Local\Temp
Group: Malware file
Last Updated: November 20, 2012
%SystemDrive%\Users\<username>\AppData\Local\Temp\conhost.dll File name: conhost.dll
Size: 176.12 KB (176128 bytes)
MD5: 7708984c7c01a41098cba5b8854a604e
Detection count: 13
File type: Dynamic link library
Mime Type: unknown/dll
Path: %SystemDrive%\Users\<username>\AppData\Local\Temp
Group: Malware file
Last Updated: October 5, 2012
%SystemDrive%\Users\<username>\AppData\Local\Temp\wgsdgsdgdsgsd.exe File name: wgsdgsdgdsgsd.exe
Size: 313.34 KB (313344 bytes)
MD5: 6306ca18606277be257eb8db30e2590e
Detection count: 9
File type: Executable File
Mime Type: unknown/exe
Path: %SystemDrive%\Users\<username>\AppData\Local\Temp
Group: Malware file
Last Updated: October 5, 2012

More files
Loading...