live casino online

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

L?scht Dateien, so dass Programme und Anwendungen nicht ordnungsgem?? ausgef��hrt werden.

Verbindet sich mit einer Website, um Daten zu versenden und zu empfangen.

?bertragungsdetails

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

Schleust folgende Komponentendateien ein:

• {Malware Path}\{Malware Filename}as.sys -> detected as PUA.Win32.PCHunter.C.component

F��gt die folgenden Prozesse hinzu:

• ��%System%\rundll32.exe�� url.dll,FileProtocolHandler http://www.{BLOCKED}oft.com -> if file is not the newest version

Autostart-Technik

Registriert sich als Systemdienst, damit sie bei jedem Systemstart automatisch ausgef��hrt wird, indem sie die folgenden Registrierungseintr?ge hinzuf��gt:

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
services\{Malware Filename}as

Andere System?nderungen

L?scht die folgenden Dateien:

• {Malware Path}\{Malware Filename}as.sys

F��gt die folgenden Registrierungseintr?ge hinzu:

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
services\{Malware Filename}as
Type = 1

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
services\{Malware Filename}as
ErrorControl = 1

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
services\{Malware Filename}as
Start = 1

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
services\{Malware Filename}as
ImagePath = \??\{Malware Path}\{Malware Filename}as.sys

Backdoor-Routine

Verbindet sich mit den folgenden Websites, um Daten zu versenden und zu empfangen.

• http://www.{BLOCKED}oft.com
• http://www.{BLOCKED}oft.com/PCHunter_StandardV1.56={MAC Address}
• http://www.{BLOCKED}oft.com/statistics/epoolsoft.html?PCHunter_Standard={MAC Address}
• http://www.{BLOCKED}oft.com/pchunter/pchunter_free

Datendiebstahl

Folgende Daten werden gesammelt:

• MAC Address
• Running Processes
• Computer Files
• User Accounts
• System Registries
• Process Modules
• Kernel Modules
• Startup Information
• Network Connections
• Firewall Rules

Andere Details

Es macht Folgendes:

• It loads the dropped file as a driver
  • {Malware Path}\{Malware Filename}as.sys
• It connects to http://www.{BLOCKED}oft.com if product version is not V1.56 or the date is January 13, 2019
• It displays the following image:
  
• It can view and display system process and process threads
• It can terminate, suspend and resume processes and threads
• It displays current network connections, including the local and remote addresses and state of TCP connections
• It displays and can edit system registry
• It displays and can delete files and folders
• It can view file properties information
• It displays autorun entries
• It can delete and edit autorun entries
• It displays and can delete user accounts
• It displays affected machine��s firewall rules
• It can delete a firewall rule