Eshragh PassSender
Copyright © MegaSecurity
By eShargh
Informations
| From | The Middle East |
| Author | eShargh |
| Family | Eshragh PassSender |
| Category | Information Stealer |
| Version | Eshragh PassSender |
| Language | Visual Basic |
Additional Information
Server
Dropped File:
c:\WINDOWS\system32\system.exe
Size: 86,176 bytes
Added to Registry:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\system "disableregistrytools"
Data: 01, 00, 00, 00
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\system "DisableTaskMgr"
Data: 01, 00, 00, 00
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "System"
Data: system.exe
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\stud "ImagePath"
Data: %SystemRoot%\System32\oobe\setup\svchost.exe /service
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\stud "ImagePath"
Data: %SystemRoot%\System32\oobe\setup\svchost.exe /service
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\stud "ImagePath"
Data: %SystemRoot%\System32\oobe\setup\svchost.exe /service
Tested on Windows XP
September 06, 2008If you recognize any personal information on this page and wish to have it removed or redacted, please contact us at jplesueur@phrozen.io. We are committed to protecting your privacy in accordance with GDPR regulations.