Home / malware

PDF

Trojan:Win32/BBSwift.A

First posted on 02 June 2016.
Source: Microsoft

Aliases :

There are no other names known for Trojan:Win32/BBSwift.A.

Explanation :

Installation

This threat is used as a component named evtdiag.exe for TrojanSpy:Win32/BBSwift.A.



Payload

This threat creates a batch file in the %TEMP% directory named evchk.bat that runs to delete the malware in the system.



Analysis by: Marianne Mallen

Last update 02 June 2016

 

TOP