Home Malware Programs Trojans Trojan.Spambot.11349

Trojan.Spambot.11349

Posted: May 24, 2012

Threat Metric

Threat Level: 8/10
Infected PCs: 398
First Seen: May 24, 2012
Last Seen: October 10, 2023
OS(es) Affected: Windows

Trojan.Spambot.11349 is a Trojan that infects the targeted PC system via security loopholes and unsafe downloads. Trojan.Spambot.11349 can also infect the computer system via malicious spam email attachments and bogus video media codecs. Once installed, Trojan.Spambot.11349 creates the certain files on the PC system. Trojan.Spambot.11349 can also delete particular files on the infected computer. Trojan.Spambot.11349 replaces the HOSTS file. Trojan.Spambot.11349 modifies the Windows registry by changing some registry keys. To avoid firewall, Trojan.Spambot.11349 removes or modifies the particular registry keys.

Aliases

Trj/CI.A [Panda]Generic32.CKRP [AVG]Dropper/Win32.Injector [AhnLab-V3]Heuristic.LooksLike.Win32.Suspicious.B [McAfee-GW-Edition]Trojan-Dropper.Win32.Injector.idwe [Kaspersky]PWS-Zbot-FAQD!072419361172 [McAfee]W32/Jorik.CTPG!tr [Fortinet]Heur.Suspicious [Comodo]Trojan-Ransom.Win32.PornoAsset.cfbu [Kaspersky]WS.Reputation.1 [Symantec]PWS-Zbot-FAQD!B9521019D1DC [McAfee]Suspicious file [Panda]Generic28.BTNU [AVG]W32/Kryptik.WDV!tr [Fortinet]Packed.Win32.Krap [Ikarus]
More aliases (32)

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:



ferest1.tmp File name: ferest1.tmp
Size: 176.23 KB (176239 bytes)
MD5: 4cb4d565fbd459a0da0b3c42c09dd5d7
Detection count: 60
File type: Temporary File
Mime Type: unknown/tmp
Group: Malware file
Last Updated: June 20, 2012
SVCNOST.EXE File name: SVCNOST.EXE
Size: 109.53 KB (109536 bytes)
MD5: 4a849ba946d2dd7af4d12f9f5ad15858
Detection count: 57
File type: Executable File
Mime Type: unknown/EXE
Group: Malware file
Last Updated: June 20, 2012
%USERPROFILE%\qokozypkabaq.exe File name: qokozypkabaq.exe
Size: 86.14 KB (86141 bytes)
MD5: b9521019d1dcbedd8eee170c7219ac20
Detection count: 42
File type: Executable File
Mime Type: unknown/exe
Path: %USERPROFILE%
Group: Malware file
Last Updated: May 1, 2013
%SYSTEMDRIVE%\Users\<username>\Desktop\a trubsil spambot.exe\file.exe File name: file.exe
Size: 417.28 KB (417280 bytes)
MD5: 9342dc72e9b7597d1a7ff2c80eeda966
Detection count: 23
File type: Executable File
Mime Type: unknown/exe
Path: %SYSTEMDRIVE%\Users\<username>\Desktop\a trubsil spambot.exe
Group: Malware file
Last Updated: June 26, 2020
%SystemDrive%\windows\temp\svchost.exe File name: svchost.exe
Size: 265.49 KB (265493 bytes)
MD5: 0724193611725860c9e006984f901550
Detection count: 9
File type: Executable File
Mime Type: unknown/exe
Path: %SystemDrive%\windows\temp
Group: Malware file
Last Updated: May 8, 2013
%AppData%\ntuser.dat File name: %AppData%\ntuser.dat
File type: Data file
Mime Type: unknown/dat
Group: Malware file
%AppData%\desktop.ini File name: %AppData%\desktop.ini
Mime Type: unknown/ini
Group: Malware file

More files

Registry Modifications

The following newly produced Registry Values are:

HKEY..\..\{Value}HKEY_LOCAL_MACHINE>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List '%APPDATA%\x3ctnjmbqssceevmcdfs2pzhzy3sknhv2\svcnost.exe' = '%APPDATA%\x3ctnjmbqssceevmcdfs2pzhzy3sknhv2\svcnost.exe:*:EnaHKEY_CURRENT_USER>\Software\Microsoft\Windows\CurrentVersion\Run 'Windows Init'= '"%APPDATA%\x3ctnjmbqssceevmcdfs2pzhzy3sknhv2\svcnost.exe"'HKEY..\..\..\..{RegistryKeys}SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\purplefeather.exeSOFTWARE\Microsoft\Windows\CurrentVersion\Run\PurpleFeather

Additional Information

The following directories were created:
%APPDATA%\PurpleFeather
Loading...