Home / malware Trojan:Win32/Pirminay.A
First posted on 22 May 2014.
Source: MicrosoftAliases :
There are no other names known for Trojan:Win32/Pirminay.A.
Explanation :
Threat behavior
Installation
Trojan:Win32/Pirminay.A creates the following files on your PC:
Note:
\kbdcanj.exe - c:\documents and settings\administrator\local settings\temp\~unins375.bat
refers to a variable location that is determined when the malware queries your operating system. The default installation location for the system folder for Windows 2000 and NT is C:\Winnt\System32; and for XP, Vista, and 7 is C:\Windows\System32. The malware deletes the original copy of the worm by making the following registry change:
Sets value: "PendingFileRenameOperations"
With data: ".exe"
In subkey: HKLM\SYSTEM\CurrentControlSet\Control\Session Manager
Payload
Contacts remote host
Trojan:Win32/Pirminay.A might contact a remote host at 18.107.138.200 using port 80. Commonly, malware does this to:This malware description was produced and published using automated analysis of file SHA1 3c7fdcb8fa25badc6309840f868c0ee544cd82c9.Symptoms
- Report a new infection to its author
- Receive configuration or other data
- Download and run files, including updates or other malware
- Receive instructions from a remote hacker
- Upload data taken from your PC
System changes
The following could indicate that you have this threat on your PC:
- You have these files:
\kbdcanj.exe
c:\documents and settings\administrator\local settings\temp\~unins375.bat
- You see these entries or keys in your registry:
Sets value: "PendingFileRenameOperations"
With data: ".exe"
In subkey: HKLM\SYSTEM\CurrentControlSet\Control\Session ManagerLast update 22 May 2014