Home Malware Programs Viruses Virus.Lehzub.A

Virus.Lehzub.A

Posted: April 15, 2013

Threat Metric

Threat Level: 8/10
Infected PCs: 440
First Seen: April 15, 2013
Last Seen: May 10, 2023
OS(es) Affected: Windows

Virus.Lehzub.A is a virus, which can lock down a targeted computer and demand a ransom from an affected PC user to be paid to unlock the PC. Virus.Lehzub.A may take over the victimized computer user's personal online accounts to distribute various malware threats to the infected computer systems. Virus.Lehzub.A contain rootkit capabilities, which allow it to disguise itself on the corrupted PC from detection and removal with security software. Virus.Lehzub.A can record the victim's keystrokes to gain login data and hijack the virtual email and IM chat accounts to deliver the ransomware to the hacked PC and other computers. Virus.Lehzub.A can download other malware infections and disable the Registry Editor. Virus.Lehzub.A can display fake system pop-up messages, disable Safe Mode and affect USB drives. Virus.Lehzub.A drops the malicious files that use the names of the legitimate Windows components. Once Virus.Lehzub.A infects the vulnerable computer system, it can block access to the desktop and display a bogus legal alert supposedly sent by the Police.

Aliases

MSIL.K [AVG]Trojan/Win32.Agent [AhnLab-V3]Gen:Heur.MSIL.Krypt.2 [BitDefender]Trojan.MSIL.Agent.athu [Kaspersky]MSIL:Crypt-KB [PUP] [Avast]Generic32.AUQA [AVG]W32/Generic!tr [Fortinet]Win32:Rootkit-gen [GData]Trojan.Spamlink.30 [DrWeb]Mal/Generic-S [Sophos]Win32:Rootkit-gen [Rtk] [Avast]Artemis!74577BCA1FA1 [McAfee]SHeur4.AVPZ [AVG]TR/Agent.AQTJ.2 [AntiVir]Win32:Agent-AQTJ [Trj] [Avast]
More aliases (239)

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:



%APPDATA%\9AEB.exe File name: 9AEB.exe
Size: 122.88 KB (122880 bytes)
MD5: 74577bca1fa1df19e81366cada27a1e1
Detection count: 82
File type: Executable File
Mime Type: unknown/exe
Path: %APPDATA%
Group: Malware file
Last Updated: April 22, 2013
%APPDATA%\5D5A9D\5D5A9D.exe File name: 5D5A9D.exe
Size: 183.86 KB (183869 bytes)
MD5: 6ad20051a3accd68b202978070953a83
Detection count: 56
File type: Executable File
Mime Type: unknown/exe
Path: %APPDATA%\5D5A9D
Group: Malware file
Last Updated: April 17, 2013
%APPDATA%\Microsoft\Windows\uaccache.exe File name: uaccache.exe
Size: 31.23 KB (31232 bytes)
MD5: 44c3a63b0fa86f3706dbfb2462b4a65e
Detection count: 14
File type: Executable File
Mime Type: unknown/exe
Path: %APPDATA%\Microsoft\Windows
Group: Malware file
Last Updated: April 22, 2013
%WINDIR%\sysctrl.exe File name: sysctrl.exe
Size: 2.45 MB (2450944 bytes)
MD5: cc4e68780e391a5a513f6c05af0238b7
Detection count: 9
File type: Executable File
Mime Type: unknown/exe
Path: %WINDIR%
Group: Malware file
Last Updated: April 17, 2013
%APPDATA%\XhsX.exe File name: XhsX.exe
Size: 671.23 KB (671232 bytes)
MD5: a7bf8c62f1df8af3e2fdc1f006540c86
Detection count: 7
File type: Executable File
Mime Type: unknown/exe
Path: %APPDATA%
Group: Malware file
Last Updated: April 17, 2013
%TEMP%\YEkZgzU.exe File name: YEkZgzU.exe
Size: 46.07 KB (46070 bytes)
MD5: b6ab43e35fbf495250a84496b4e2bfc7
Detection count: 5
File type: Executable File
Mime Type: unknown/exe
Path: %TEMP%
Group: Malware file
Last Updated: April 17, 2013
%APPDATA%\Microsoft\Windows\uaccache.exe File name: uaccache.exe
Size: 31.23 KB (31232 bytes)
MD5: 914f1a168b2982f303aaded21c14c31a
Detection count: 5
File type: Executable File
Mime Type: unknown/exe
Path: %APPDATA%\Microsoft\Windows
Group: Malware file
Last Updated: April 22, 2013
%APPDATA%\23E5.exe File name: 23E5.exe
Size: 91.8 KB (91800 bytes)
MD5: 0f7daa18c8a835fa646da9ac75b6a3a3
Detection count: 5
File type: Executable File
Mime Type: unknown/exe
Path: %APPDATA%
Group: Malware file
Last Updated: April 17, 2013

Additional Information

The following messages's were detected:
# Message
1Your computer has been locked!
Illegally downloaded material (MP3’s, Movies or Software) has been located on your computer. […]
To unlock your computer and to avoid other legal consequences, you are obliged to pay a release fee of $200. Payable through GreenDot Moneypak.
After successful payment, your computer will automatically unlock.

Loading...