Home Malware Programs Trojans W32/Yakes.B!tr

W32/Yakes.B!tr

Posted: October 19, 2011

Threat Metric

Threat Level: 9/10
Infected PCs: 143
First Seen: October 19, 2011
Last Seen: May 4, 2021
OS(es) Affected: Windows

W32/Yakes.B!tr is a malicious Trojan which is involved in the Internal Revenue Service (IRS) malware campaign. The spam email with the title "Last Notice" allegedly coming from the IRS contains a malicious attachment named "IRS_Calculations_#ID6749.zip". If the infected attachment is opened and the file is run, W32/Yakes.B!tr infects your machine. If you have received a fake IRS "Last Notice" email message, ignore it, and delete from your inbox as quickly as possible.

Aliases

TR/Kazy.156377 [AntiVir]Trojan.Siggen5.3175 [DrWeb]Heur.Suspicious [Comodo]Backdoor.Win32.IRCBot.aepk [Kaspersky]PWS-Zbot-FAQO!228796B0C718 [McAfee]Trj/Dtcontx.C [Panda]Troj/Zbot-EGQ [Sophos]Artemis!AADA2999CA19 [McAfee-GW-Edition]RDN/Generic.bfr!bh [McAfee]Trojan-Ransom.Win32.Blocker.awyl [Kaspersky]Trojan Horse [Symantec]Trojan-Ransom.Win32.Blocker.awuw [Kaspersky]SHeur4.BDTH [AVG]Trojan-Ransom.Win32.Blocker [Ikarus]TR/Ransom.Blocker.awjc [AntiVir]
More aliases (111)

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:



%APPDATA%\e81236cb-87d4-469a-8919-ea4322547946.exe File name: e81236cb-87d4-469a-8919-ea4322547946.exe
Size: 41.98 KB (41984 bytes)
MD5: da6ebac1d8016d0c74e351ae4c64f807
Detection count: 76
File type: Executable File
Mime Type: unknown/exe
Path: %APPDATA%
Group: Malware file
Last Updated: March 21, 2013
%ALLUSERSPROFILE%\Local Settings\Temp\f2e6fe2e.com File name: f2e6fe2e.com
Size: 36.86 KB (36864 bytes)
MD5: e31213f10015971d860474495d21fb69
Detection count: 72
File type: Command, executable file
Mime Type: unknown/com
Path: %ALLUSERSPROFILE%\Local Settings\Temp
Group: Malware file
Last Updated: October 25, 2011
%APPDATA%\Microsoft\Internet Explorer\checkdisku.exe File name: checkdisku.exe
Size: 88.57 KB (88576 bytes)
MD5: b4585c4492446882fc861414e47e073c
Detection count: 33
File type: Executable File
Mime Type: unknown/exe
Path: %APPDATA%\Microsoft\Internet Explorer
Group: Malware file
Last Updated: March 29, 2013
%LOCALAPPDATA%\Skype\Skype.exe File name: Skype.exe
Size: 57.85 KB (57856 bytes)
MD5: 43198ee4c63651fd7383ad7b5a322a18
Detection count: 31
File type: Executable File
Mime Type: unknown/exe
Path: %LOCALAPPDATA%\Skype
Group: Malware file
Last Updated: March 2, 2012
revalver_mk3_keygen_taringa.exe File name: revalver_mk3_keygen_taringa.exe
Size: 78.33 KB (78336 bytes)
MD5: df6006f869175cd1af6e8a602b9da263
Detection count: 26
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
Last Updated: October 20, 2011
revalver_mk3_keygen_taringa.exe File name: revalver_mk3_keygen_taringa.exe
Size: 78.33 KB (78336 bytes)
MD5: d79de11e9107c3bad89b018e0bbdc98c
Detection count: 25
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
Last Updated: October 20, 2011
revalver_mk3_keygen_taringa.exe File name: revalver_mk3_keygen_taringa.exe
Size: 78.33 KB (78336 bytes)
MD5: c6339d449a6a994ba1cace3a4ea56274
Detection count: 21
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
Last Updated: October 20, 2011
revalver_mk3_keygen_taringa.exe File name: revalver_mk3_keygen_taringa.exe
Size: 68.68 KB (68688 bytes)
MD5: 5078db0e6547988da0242e664e685e38
Detection count: 20
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
Last Updated: October 20, 2011
%APPDATA%\Microsoft\Protect\ekxsekx.exe File name: ekxsekx.exe
Size: 90.62 KB (90624 bytes)
MD5: 9dc0e96a6274b634fdbf3d6b61d8bcce
Detection count: 13
File type: Executable File
Mime Type: unknown/exe
Path: %APPDATA%\Microsoft\Protect
Group: Malware file
Last Updated: November 1, 2011
%USERPROFILE%\Application Data\csrss.exe File name: csrss.exe
Size: 33.28 KB (33280 bytes)
MD5: 9c00a7da813107d645889f2fad2973bf
Detection count: 13
File type: Executable File
Mime Type: unknown/exe
Path: %USERPROFILE%\Application Data
Group: Malware file
Last Updated: January 24, 2012
%ALLUSERSPROFILE%\Local Settings\Temp\mspzoxya.pif File name: mspzoxya.pif
Size: 33.79 KB (33792 bytes)
MD5: f491d31f424895798c1048207fa735a6
Detection count: 9
Mime Type: unknown/pif
Path: %ALLUSERSPROFILE%\Local Settings\Temp
Group: Malware file
Last Updated: March 2, 2012
%SystemDrive%\Documents and Settings\Guest\Application Data\Microsoft\nbcayu.exe File name: nbcayu.exe
Size: 1.86 MB (1860096 bytes)
MD5: e5b92af310683bbd12dbbac54e3eac99
Detection count: 5
File type: Executable File
Mime Type: unknown/exe
Path: %SystemDrive%\Documents and Settings\Guest\Application Data\Microsoft
Group: Malware file
Last Updated: June 22, 2012
%SystemDrive%\Users\<username>\AppData\Roaming\a9f80a6a-b7af-4390-96e9-8d30bb426ff7.exe File name: a9f80a6a-b7af-4390-96e9-8d30bb426ff7.exe
Size: 39.42 KB (39424 bytes)
MD5: aada2999ca199bbdc00f673f941887f8
Detection count: 5
File type: Executable File
Mime Type: unknown/exe
Path: %SystemDrive%\Users\<username>\AppData\Roaming
Group: Malware file
Last Updated: March 21, 2013
%USERPROFILE%\Lokale Einstellungen\Anwendungsdaten\Adobe\nVDLNGfW.exe File name: nVDLNGfW.exe
Size: 924.16 KB (924160 bytes)
MD5: f92324beb799f8e7b09d674eb8476b25
Detection count: 5
File type: Executable File
Mime Type: unknown/exe
Path: %USERPROFILE%\Lokale Einstellungen\Anwendungsdaten\Adobe
Group: Malware file
Last Updated: July 12, 2013
%SystemDrive%\Users\<username>\Local Settings\Temp\mshpiqai.exe File name: mshpiqai.exe
Size: 41.98 KB (41984 bytes)
MD5: 5f4720bc139ff1a0f1454bf57f2653d2
Detection count: 1
File type: Executable File
Mime Type: unknown/exe
Path: %SystemDrive%\Users\<username>\Local Settings\Temp
Group: Malware file
Last Updated: January 28, 2013
Loading...