Home / malware

PDF

TrojanDownloader:Win32/Ratosto.A

First posted on 16 December 2014.
Source: Microsoft

Aliases :

There are no other names known for TrojanDownloader:Win32/Ratosto.A.

Explanation :

Threat behavior

Installation


It modifies the registry so that it runs each time you start your PC. For example:

In subkey: HKCU\software\microsoft\windows\currentversion\run
Sets value: "Samsung Appstore"
With data: ""%APPDATA%\mozila\scvhost.exe" "sevdim inanamayacagin kadar seni esmer kiz kirpiklerimde cirpinan su tuzlu gozyasimda ihanetin adi yok""



Payload


Connects to a remote host

We have seen this threat connect to a remote host, including:

• www.porschealacam.com using port 80

Malware can connect to a remote host to do any of the following:

• Check for an Internet connection
• Download and run files (including updates or other malware)
• Report a new infection to its author
• Receive configuration or other data
• Receive instructions from a malicious hacker
• Search for your PC location
• Upload information taken from your PC
• Validate a digital certificate

We have seen this threat access online content, including:

• yenilink.dat
• ver.dat

This malware description was published using automated analysis of file SHA1 25791ccc8a11fdc9a72eaa9401c30f5d0bb8fb17. Symptoms

The following can indicate that you have this threat on your PC:

• You see registry modifications such as:
  
  • In subkey: HKCU\software\microsoft\windows\currentversion\run
    Sets value: "Samsung Appstore"
    With data: ""%APPDATA%\mozila\scvhost.exe" "sevdim inanamayacagin kadar seni esmer kiz kirpiklerimde cirpinan su tuzlu gozyasimda ihanetin adi yok""
    
    

Last update 16 December 2014

 

TOP