 명칭: Trojan.Reaver 발령일시: 2017.11.15 유형: 트로이 위험도: 하 해당시스템: 윈도 주요증상: 악성코드 활동 수행 2017/11/15(수) | |
 Trojan.Reaver 발령일시 : 11월15일 유형 : 트로이 위험도 : ★☆☆☆☆ 해당시스템 : 윈도 주요증상 : 악성코드 활동 수행 Infection Length: Varies Systems Affected: Windows Trojan.Reaver is a Trojan horse that may perform malicious activities on the compromised computer. ===== Once executed, the Trojan creates the following files: •%Temp%\winhelp.dat •%Temp%\~Update.lnk •%CommonProgramFiles%\Services\winhelp.dat •%CommonProgramFiles%\Services\winhelp.cpl •%CommonProgramFiles%\Services\winhelp.cpl •%AppData%\microsoft\mmc\winhelp.dat •%AppData%\microsoft\mmc\winhelp.cpl •%AppData%\microsoft\mmc\winhelp.cpl •%AppData%\Random_name\updata.log •%AppData%\Random_name\sppsvc.exe •%AppData%\Random_name\sppsvc.exe •%SystemDrive%\Documents and Settings\All Users\Start Menu\Programs\Startup\dwm.lnk •%SystemDrive%\Documents and Settings\All Users\Start Menu\Programs\Startup\sppsvc.lnk The Trojan creates the following registry entries: •HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\helpsvc\Parameters\"ServiceDll" = "%CommonProgramFiles%\Services\winhelp.cpl "" •HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\helpsvc\"DisplayName" = "Windows Multimedia Service" •HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\helpsvc\"Description" = "Windows Multimedia Service for media devices" Next, the Trojan connects to the following remote location: •[http://]www.fyoutside.com/DWM1UT98C6[REMOVED] The Trojan then gathers the following information from the compromised computer: •Computer name •Processor speed •IP Address •Operating system version •Memory information •Volume serial number The Trojan may then carry out the following actions on the compromised computer: •Read, write, delete, and move files •Create and end processes ▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒ Copyrightⓒ2000-2017 All rights reserved 해커즈뉴스 / 해커대학 ▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒ |
   |