Home / malware

PDF

Backdoor:Win32/Unskal.A

First posted on 06 August 2014.
Source: Microsoft

Aliases :

There are no other names known for Backdoor:Win32/Unskal.A.

Explanation :

Threat behavior

Installation

Backdoor:Win32/Unskal.A copies itself to c:\documents and settings\administrator\application data\oraclejava\javaw.exe. The malware creates the following files on your PC:

• c:\documents and settings\administrator\application data\nsskrnl

The malware uses code injection to make it harder to detect and remove. It can inject code into running processes, including the following:

• explorer.exe

Payload

Allows backdoor access and control

Backdoor:Win32/Unskal.A gives a hacker access and control of your PC. They can then perform a number of different actions, including:

• Downloading and running files
• Uploading files
• Spreading malware to other PCs
• Logging your keystrokes or stealing your sensitive data
• Modifying your system settings
• Running or stopping applications
• Deleting files

This malware description was produced and published using automated analysis of file SHA1 11b7430026c82097657c145dcedfa818bf1032d3.Symptoms

System changes

The following could indicate that you have this threat on your PC:

• You have these files:
  
  c:\documents and settings\administrator\application data\nsskrnl
  c:\documents and settings\administrator\application data\oraclejava\javaw.exe

Last update 06 August 2014

 

TOP