Need help? Ask the community or hire an expert.
Go to Avira Answers
Virus:TR/Coremhead.A.61
Date discovered:18/05/2011
Type:Trojan
In the wild:Yes
Reported Infections:Low
Distribution Potential:Low
Damage Potential:Low to medium
Static file:Yes
File size:467.904 Bytes
MD5 checksum:D09E0D0FBAAC7DE4E4EF6E68EBC91AC8
VDF version:7.11.08.60 - Wednesday, May 18, 2011
IVDF version:7.11.08.60 - Wednesday, May 18, 2011

 General Method of propagation:
   • No own spreading routine


Aliases:
   •  Kaspersky: Backdoor.Win32.Hupigon.nilp
   •  Bitdefender: Backdoor.Hupigon.234600
     Microsoft: Trojan:Win32/Coremhead


Platforms / OS:
   • Windows 2000
   • Windows XP
    Windows Vista
    Windows 7


Side effects:
   • Drops files
   • Registry modification

 Files It copies itself to the following location:
   • %PROGRAM FILES%\WinRAR\datt

 Registry The following registry keys are added:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup]
   • "64646"="%executed file%"

[HKLM\SYSTEM\CurrentControlSet\Services\SENSr]
   • "Type"=dword:00000110
   • "Start"=dword:00000002
   • "ErrorControl"=dword:00000000
   • "ImagePath"="%PROGRAM FILES%\WinRAR\datt"
   • "DisplayName"="System Event Notificationr"
   • "ObjectName"="LocalSystem"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
   • "Hidden"=dword:00000002
   • "ShowCompColor"=dword:00000001
   • "HideFileExt"=dword:00000001
   • "DontPrettyPath"=dword:00000000
   • "ShowInfoTip"=dword:00000001
   • "HideIcons"=dword:00000000
   • "MapNetDrvBtn"=dword:00000000
   • "WebView"=dword:00000001
   • "Filter"=dword:00000000
   • "SuperHidden"=dword:00000000
   • "SeparateProcess"=dword:00000000

 Miscellaneous Accesses internet resources:
   • ok172854964.3322.org

 File details Programming language:
The malware program was written in MS Visual C++.

Description inserted by Andrei Ilie on Thursday, June 9, 2011
Description updated by Andrei Ivanes on Friday, November 18, 2011

Back . . . .