TrojanSpy.Win32.EXPLORAT.A

This Trojan Spy may arrive bundled with malware packages as a malware component. It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It creates registry entries to enable its automatic execution at every system startup.

It requires its main component to successfully perform its intended routine.

Arrival Details

This Trojan Spy may arrive bundled with malware packages as a malware component.

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan Spy modifies file attributes to make files hidden.

Autostart Technique

This Trojan Spy creates registry entries to enable its automatic execution at every system startup.

Process Termination

This Trojan Spy terminates the following processes if found running in the affected system's memory:

• ME

Information Theft

This Trojan Spy gathers the following data:

• Microsoft Internet Account Manager:
  • HTTPMail User Name
  • POP3 User Name
  • POP3 Server
  • POP3 Password2
  • HTTPMail Password2
• Autocomplete credentials stored in Internet Explorer IntelliForms
• Office Outlook IMAP:
  • IMAP Password
  • IMAP Server
• Office Outlook POP3:
  • POP3 Password
  • POP3 Server
• Office Outlook HTTP:
  • HTTP Password
  • HTTP Server URL
• WindowsLive credentials
• Information stored in files ending with .rdp:
  • Full Address
  • Username
  • Domain
  • Password
• System Information:
  • Username
  • Computer Accounts
• Entry names stored in remote access phone book

Other Details

This Trojan Spy requires its main component to successfully perform its intended routine.

It does the following:

• Opens system clipboard
• It is capable of establishing connection to a specified socket
• It is capable of monitoring a particular system event using windows hook