Search
Keyword: W2KM_MONALIS
" HKEY_CURRENT_USER\Software\Microsoft\ Internet Account Manager\Accounts\Bigfoot LDAP Server ID = "1" HKEY_CURRENT_USER\Software\Microsoft\ Internet Account Manager\Accounts\VeriSign LDAP Server ID = "2
This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. Arrival Details This Trojan arrives on a system as a
\vcredist_x86.exe %User Temp%\68$$.Ico %User Temp%\2$$.Ico %User Temp%\0$$.Ico %Program Files%\WinPcap\Uninstall.exe (Note: %System Root% is the root folder, which is usually C:\. It is also where the operating
modifies the following registry entries: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\ Services\wscsvc Start = "3" (Note: The default value data of the said registry entry is 2 .) Dropping Routine This Trojan
%\KHATRA.exe" HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\Explorer\ Advanced Hidden = "0" (Note: The default value data of the said registry entry is 2 .) HKEY_LOCAL_MACHINE\SOFTWARE
This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. Arrival Details This Trojan arrives on a system as a
" HKEY_CURRENT_USER\Software\Microsoft\ Internet Account Manager\Accounts\VeriSign LDAP Server ID = "2" HKEY_CURRENT_USER\Software\Microsoft\ Internet Account Manager\Accounts\WhoWhere LDAP Server ID = "3
"C96DE2354CB26C945552" HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows\CurrentVersion\Setup LogLevel = "2" HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows\CurrentVersion\Setup LogLevel = "0" It modifies the following
This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. It connects to certain websites to send and receive
\xerox\Desktop_2.ini %User Temp%\48$$.Ico %Program Files%\xerox\nwwia\Desktop_2.ini %System Root%\RECYCLER\Desktop_2.ini %User Temp%\2$$.Ico %System Root%\RECYCLER
\ Services\spsrv Start = "2" HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\ Services\spsrv DependOnService = "RPCSS" HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\ Services\spsrv Description = "This Windows
This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. It connects to certain websites to send and receive
" "shell_scripts/check_if_cscript_is_working.js" cscript "shell_scripts/check_if_cscript_is_working.js" "%System%\PING.EXE" 8.8.8.8 -n 2 -w 500 ping 8.8.8.8 -n 2 -w 500 "%System%\cscript.exe" shell_scripts/shell_ping_after_close.js "http://i-50.
This Adware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. Arrival Details This Adware arrives on a system as a
This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. It encrypts files with specific file extensions. It
This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. Arrival Details This Trojan arrives on a system as a
characters}" It modifies the following registry entries: HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\Explorer\ Advanced Hidden = "2" (Note: The default value data of the said registry entry is
\ Advanced Hidden = "2" (Note: The default value data of the said registry entry is 2 .) HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\Explorer\ Advanced SuperHidden = "0" HKEY_LOCAL_MACHINE
This file infector arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. It deletes itself after execution. Arrival
HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\Explorer\ Advanced Hidden = "2" (Note: The default value data of the said registry entry is 2 .) HKEY_CURRENT_USER\Software\Microsoft\ Windows