Virus: TR/Obisty.A Date discovered: 19/12/2012 Type: Trojan In the wild: No Reported Infections: Medium Distribution Potential: Low Damage Potential: Medium Static file: Yes File size: 148.992 Bytes MD5 checksum: 89FA070B12AEE94C97F15AFBC8404E00 VDF version: 7.11.54.86 - Wednesday, December 19, 2012IVDF version: 7.11.54.86 - Wednesday, December 19, 2012
General Method of propagation: JS/Redirector.SB EXP/Pidief.zar Platforms / OS: Side effects: Files %eight-digit random character string% .exe%TEMPDIR% \exp3.tmp.bat Furthermore it gets executed after it was fully created. This batch file is used to delete a file. Registry %eight-digit random character string% .exe Backdoor Contact server: %random character string% /%random character string% /%random character string% %random character string% /%random character string% /%random character string% %random character string% /%random character string% /%random character string% %random character string% /%random character string% /%random character string% %random character string% /%random character string% /%random character string% %random character string% /%random character string% /%random character string% %random character string% /%random character string% /%random character string% %random character string% /%random character string% /%random character string% %random character string% /%random character string% /%random character string% %random character string% /%random character string% /%random character string% %random character string% /%random character string% /%random character string% %random character string% /%random character string% /%random character string% %random character string% /%random character string% /%random character string% %random character string% /%random character string% /%random character string% %random character string% /%random character string% /%random character string% %random character string% /%random character string% /%random character string% %random character string% /%random character string% /%random character string% %random character string% /%random character string% /%random character string% %random character string% /%random character string% /%random character string% %random character string% /%random character string% /%random character string% %random character string% /%random character string% /%random character string% %random character string% /%random character string% /%random character string% %random character string% /%random character string% /%random character string% %random character string% /%random character string% /%random character string% %random character string% /%random character string% /%random character string% %random character string% /%random character string% /%random character string% Injection File details Programming language: The malware program was written in MS Visual C++. Runtime packer:
Description inserted by Liviu Serban on Wednesday, December 19, 2012
Back
.
.
.
.
