Spyware ALIASES for: PAK:PE Patch / PAK:ASProtect

PUA.Win32.Packer.Asprotect-2 (Clamav)

• http://www.clamav.net/lang/en/

Win32.SuspectCrc (Ikarus)

• http://www.ikarussecurity.com/

PAK:PE Patch (PAK:ASProtect) (Kaspersky)

• http://www.securelist.com/en/descriptions/29810394/ASProtect

Packed.Win32.Black.d

"It is packed using PE Patch and ASprotect."

• http://www.securelist.com/en/descriptions/6134039/Packed.Win32.Black.d

Trojan-Dropper.Win32.Delf.grq

"It is packed using ASprotect. The unpacked file is approximately 915 KB in size. It is written in Delphi."

• http://www.securelist.com/en/descriptions/16268043/Trojan-Dropper.Win32.Delf.grq

PWS:Win32/Zbot.AFW (Microsoft)

"This password-stealing trojan can monitor your keystrokes and send the recorded information to a hacker. This can include your online activity such as visits to banking websites."

• http://www.microsoft.com/security/portal/threat/encyclopedia/entry.aspx?Name=Win32/Zbot

Trojan.Win32.Generic!BT (Sunbelt)

• http://www.lavasoft.com/mylavasoft/malware-descriptions/blog/backdoorwin32poisontrojanwin32genericbt

TSPY_ZBOT.TE (TrendMicro)

"This spyware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. It modifies the Internet Explorer Zone Settings. It deletes itself after execution."

• http://about-threats.trendmicro.com/malware.aspx?language=au&name=TSPY_ZBOT.TE

Variant of Win32/Kryptik.AIJU trojan (NOD32)

• https://www.virustotal.com/de/file/0a5bf022f878ee811a038a1fd9c8cedfd5d13e7bb028542e4bc7469fdc3272e1/analysis/

ANALYZING HASHES MD5: 589eb00c8d071f8b81a782772dde514a PUA.Win32.Packer.Asprotect-2 (Heur.Win32.Veebee.3!O)

FROM:

http://athan.islamicfinder.org/screensavers/Ramadan1.exe

• https://www.virustotal.com/de/url/2ffeb9ca413dc2756602d3650c0d178698b0b19c573bfeeedbb46584842934f4/analysis/1399297572/

PUA.Win32.Packer.Asprotect-2

• https://www.virustotal.com/de/file/7e6b28c0b34dd2bf037e80016e38636e64e5d9e0f7ad939c69c4895e32e74200/analysis/1399297418/

• https://urlquery.net/report.php?id=1399297906951

MD5: 589eb00c8d071f8b81a782772dde514a INCLUDES:

1) ConfigureScr.exe

• https://www.virustotal.com/de/file/dd4d2dd4690f895ee3e4a6dc319e8ed4e7282f21bc818dfed49068873fc01353/analysis/1399298315/

2) Ramadan1.SCR

Heur.Win32.Veebee.3!O

PUA.Win32.Packer.Asprotect-2

• https://www.virustotal.com/de/file/cdc9ed6d336b530f70adce5e836eccd5da7ec06447594a3830ed10af20f18dcd/analysis/

3) RemoveScr.exe

• https://www.virustotal.com/de/file/52a7f3cb893fdaf4aa2a7f20b585047b2b128b07a10d7f0606222d990d40cd49/analysis/1399298943/