Home Malware Programs Trojans Trojan:Win32/Matsnu.D

Trojan:Win32/Matsnu.D

Posted: May 15, 2013

Threat Metric

Threat Level: 9/10
Infected PCs: 73
First Seen: May 15, 2013
Last Seen: January 25, 2020
OS(es) Affected: Windows

Trojan:Win32/Matsnu.D is a Trojan that makes changes to the infected computer to make it more vulnerable for other malware infections, and contacts a remote host to retrieve commands that can have practically any intention. Once installed and executed, Trojan:Win32/Matsnu.D makes system changes by modifying the Windows Registry. Trojan:Win32/Matsnu.D copies itself to the certain locations with a random file name. Trojan:Win32/Matsnu.D modifies the registry entries to make sure that its copy runs automatically every time Windows is started. Trojan:Win32/Matsnu.D disables registry editing tools and task manager by making the registry modifications. Trojan:Win32/Matsnu.D deletes the original copy of itself that runs when the computer user restarts the computer by making the registry modifications. Trojan:Win32/Matsnu.D uses code injection in order to avoid detection and removal, it inserts a code and creates a remote thread in the running processes of 'svchost.exe'.

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:



[system folder]\6c135f46acc0e9de4b69.exe File name: [system folder]\6c135f46acc0e9de4b69.exe
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
%TEMP%\cdbukngmoz.pre File name: %TEMP%\cdbukngmoz.pre
Mime Type: unknown/pre
Group: Malware file

Registry Modifications

The following newly produced Registry Values are:

HKEY..\..\{Value}HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System "DisableRegistryTools" = "1"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager "PendingFileRenameOperations" = "c:\documents and settings\administrator\local settings\temp\cdbukngmoz.pre"HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon "userinit" = "[system folder]\userinit.exe, [system folder]\6c135f46acc0e9de4b69.exe,"HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe "Debugger " = "p9kdmf.exe"HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe "Debugger " = "p9kdmf.exe"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System "DisableRegedit" = "1"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System "DisableTaskMgr" = "1"
Loading...