Home / malware

PDF

PWS:Win32/QQpass.GU

First posted on 15 December 2015.
Source: Microsoft

Aliases :

There are no other names known for PWS:Win32/QQpass.GU.

Explanation :

Threat behavior

Installation
This threat can create files on your PC, including:

• \80400.dll

It also deletes the following registry entries to bypass proxy settings:

• "ProxyServer" under HKU\Administrator\Software\Microsoft\windows\CurrentVersion\Internet Settings
• "ProxyOverride" under HKU\Administrator\Software\Microsoft\windows\CurrentVersion\Internet Settings
• "AutoConfigURL" under HKU\Administrator\Software\Microsoft\windows\CurrentVersion\Internet Settings

Payload


Steals your sensitive information

This threat can steal your sensitive information, such as your user names and passwords for:

• Email or social media websites
• Banking websites
• Online games

Connects to a remote host

We have seen this threat connect to a remote host, including:

• l.hc98w.com using port 6666

Malware can connect to a remote host to do any of the following:

• Check for an Internet connection
• Download and run files (including updates or other malware)
• Report a new infection to its author
• Receive configuration or other data
• Receive instructions from a malicious hacker
• Search for your PC location
• Upload information taken from your PC
• Validate a digital certificate

This malware description was published using automated analysis of file SHA1 67fa6deeb2cacedb93b6ede05b8eebf6444f40c0.

Symptoms

The following can indicate that you have this threat on your PC:

• You see a file similar to:
  • \80400.dll

Last update 15 December 2015

 

TOP