Home / malware TrojanSpy:Win32/Realsteal.A
First posted on 31 May 2016.
Source: MicrosoftAliases :
There are no other names known for TrojanSpy:Win32/Realsteal.A.
Explanation :
Installation
This threat can create files on your PC, including:
- %USERPROFILE%\laptop-pcx86.dat
It modifies the registry so that it runs each time you start your PC. For example:
In subkey: HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Sets value: ""
With data: ""
Payload
Collects your sensitive information
This threat can collect your sensitive information without your consent. This can include:
- The keys you press
- The applications you open
- Your web browsing history
- Your credit card information
- Your user names and passwords
It can also imitate a legitimate website to lure you into revealing your sensitive information.
Connects to a remote host
We have seen this threat connect to a remote host, including:Malware can connect to a remote host to do any of the following:
- adrianoreidopastel.hospedagemdesites.ws using port 53
- Check for an Internet connection
- Download and run files (including updates or other malware)
- Report a new infection to its author
- Receive configuration or other data
- Receive instructions from a malicious hacker
- Search for your PC location
- Upload information taken from your PC
- Validate a digital certificate
This malware description was published using automated analysis of file SHA1 c1a45d26743e7dc1692ee84815bd012b72602e3c.Last update 31 May 2016