Home / malware

PDF

TrojanSpy:Win32/Wedscamp.A

First posted on 22 January 2015.
Source: Microsoft

Aliases :

There are no other names known for TrojanSpy:Win32/Wedscamp.A.

Explanation :

Threat behavior

Installation


It modifies the registry so that it runs each time you start your PC. For example:

In subkey: HKCU\software\microsoft\windows\currentversion\run
Sets value: "cespa"
With data: ""



Payload


Collects your sensitive information

This threat can collect your sensitive information without your consent. This can include:

• The keys you press
• Your web browsing history
• Your credit card information
• Your user names and passwords

It could also imitate a legitimate website to lure you into revealing your sensitive information.

It targets users of bancomer.com, the website of a Mexican bank.

This malware description was published using automated analysis of file SHA1 0fb7f0eca3238ccb91753e5ae07a0695d49400bc.Symptoms

The following can indicate that you have this threat on your PC:

• You see registry modifications such as:
  
  • In subkey: HKCU\software\microsoft\windows\currentversion\run
    Sets value: "cespa"
    With data: ""
    
    

Last update 22 January 2015

 

TOP