PS-Ware IE PS
Copyright © MegaSecurity
By Impostor
Informations
| From | Iran |
| Author | Impostor |
| Family | PS-Ware IE PS |
| Category | Information Stealer |
| Version | PS-Ware IE PS |
| Language | Visual Basic |
Additional Information
Server:
dropped files:
c:\WINDOWS\system32\regm.dat Size: 0 bytes
c:\WINDOWS\system32\regsvr.exe Size: 50,176 bytes
c:\WINDOWS\system32\WinIPV9.dll Size: 11,828 bytes
c:\WINDOWS\system32\drivers\Tioner.exe Size: 50,176 bytes
startup:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "regsvr.exe "
data: C:\WINDOWS\System32\regsvr.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{z6B2445-1963-9142-A0DB-DBDB9E15FB9z} "StubPath"
data: C:\WINDOWS\System32\drivers\Tioner.exe sysdir
tested on Windows XP
October 30, 2006If you recognize any personal information on this page and wish to have it removed or redacted, please contact us at jplesueur@phrozen.io. We are committed to protecting your privacy in accordance with GDPR regulations.