Search
Keyword: URL
\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.) It downloads a possibly malicious file from a certain URL. The URL where this malware downloads the said file depends on the following
This Trojan Spy connects to the following Facebook URL to steal victim's information: https://secure.facebook.com/payments/settings/payment_methods/?__a=1
('Net'+'.'+'Webc'+'lient'))).(('Downloadst'+'ri'+'ng')).InVokE((('http:'+'//{BLOCKED}'+'{BLOCKED}'+'{BLOCKED}'+'{BLOCKED}l.com/les'+'s.'+'da'+'t')))) It connects to the following URL to execute a malicious script: http://
URL to steal victim's information: https://secure.facebook.com/payments/settings/payment_methods/?__a=1 https://www.facebook.com//bluebar/modern_settings_menu/ https://www.facebook.com/bookmarks/pages
Trojan downloads the file from the following URL and renames the file when stored in the affected system: {BLOCKED}e.be/shop/misc/textarea.exe www.{BLOCKED}orship.org/images/index.exe It saves the files it
downloaded files. As a result, malicious routines of the downloaded files are exhibited on the affected system. It downloads a possibly malicious file from a certain URL. The URL where this malware downloads
inaccessible. Download Routine This Trojan downloads the file from the following URL and renames the file when stored in the affected system: http://www.{BLOCKED}a-fazendacnpj.info/01-12-2015/Mseserver.html
Trojan downloads the file from the following URL and renames the file when stored in the affected system: https://{BLOCKED}d.co.il/images/navigation.exe It saves the files it downloads using the following
information on the affected computer: Computer Name OS Version RAM NOTES: This backdoor pings the following URL to get its IP address where it connects to send and receive information from malicious user: file.
Spammers take advantage of the news regarding the supposedly merging of Skype, Hotmail, and MSN to lure users into downloading this malware. The spammed message includes a URL that points to this
malicious routines of the downloaded files are exhibited on the affected system. It downloads a possibly malicious file from a certain URL. The URL where this malware downloads the said file depends on the
following URL and renames the file when stored in the affected system: http://{BLOCKED}eimdoctor.biz/1xxquux http://{BLOCKED}aauto.com/tyknnq http://{BLOCKED}aginas.com/kftx6100 http://{BLOCKED}ch.at/rp9uyjw6
from the following URL and renames the file when stored in the affected system: http://{BLOCKED}uxcanwu2ru.top/log.php?f=400 It saves the files it downloads using the following names: %User Temp%\{random
Force terminate the following Processes: SpyTheSpy.exe TiGeR-Firewall.exe bavtray.exe Check if running under virtual machine Create a shortcut that will go to a specified url at every system startup Hide
the file from the following URL and renames the file when stored in the affected system: https://{BLOCKED}esteward.com/css/Document1704.exe It saves the files it downloads using the following names:
HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion path = {malware file path}\{malware file name} Download Routine This Trojan downloads the file from the following URL and renames the file when stored in
Socks proxy (port to use, IP address to allow, IP address to deny, User-Agent, view server info, end proxy service) List, add, delete, or modify a user account Download file from a URL Share a shell
inaccessible. Other Details This Exploit does the following: It connects to the following URL to execute a malicious script: https://{BLOCKED}in.com/raw/{BLOCKED}bB The malicious script may contain the following
remote attackers to read arbitrary cookies via a crafted HTML document, as demonstrated by a URL with file://example.com/C:/ at the beginning. mozilla firefox 0.1,mozilla firefox 0.10,mozilla firefox
HeartbeatTime = {Random number} Other Details This Adware does the following: It gets information from the following URL via HTTP GET: http://app.{BLOCKED}u.com/Offers?url=silent%20download&id={Random numbers