TrojanSpy.Win32.EXPLORAT.A

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Requiere que su componente principal lleve a cabo correctamente la rutina deseada.

Detalles de entrada

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Finalización del proceso

Finaliza los procesos siguientes si detecta que se ejecutan en la memoria del sistema afectado:

• ME

Robo de información

Recopila los siguientes datos:

• Microsoft Internet Account Manager:
  • HTTPMail User Name
  • POP3 User Name
  • POP3 Server
  • POP3 Password2
  • HTTPMail Password2
• Autocomplete credentials stored in Internet Explorer IntelliForms
• Office Outlook IMAP:
  • IMAP Password
  • IMAP Server
• Office Outlook POP3:
  • POP3 Password
  • POP3 Server
• Office Outlook HTTP:
  • HTTP Password
  • HTTP Server URL
• WindowsLive credentials
• Information stored in files ending with .rdp:
  • Full Address
  • Username
  • Domain
  • Password
• System Information:
  • Username
  • Computer Accounts
• Entry names stored in remote access phone book

Otros detalles

Requiere que su componente principal lleve a cabo correctamente la rutina deseada.

Hace lo siguiente:

• Opens system clipboard
• It is capable of establishing connection to a specified socket
• It is capable of monitoring a particular system event using windows hook