Home / malware

PDF

Backdoor:Win32/Wonbaful.A

First posted on 22 May 2014.
Source: Microsoft

Aliases :

There are no other names known for Backdoor:Win32/Wonbaful.A.

Explanation :

Threat behavior

Installation

Backdoor:Win32/Wonbaful.A creates the following files on your PC:

• %programfiles%\nsck.ocx
• %programfiles%\winmgmt.exe - detected as Backdoor:Win32/Wonbaful.A
• %windir%\assembly\nativeimages_v2.0.50727_32\temp\zape.tmp\microsoft.build.utilities.v3.5.dll
• %windir%\assembly\nativeimages_v2.0.50727_32\temp\zapf.tmp\microsoft.build.visualjsharp.dll

Payload

Allows backdoor access and control

Backdoor:Win32/Wonbaful.A gives a hacker access and control of your PC. They can then perform a number of different actions, including:

• Downloading and running files
• Uploading files
• Spreading malware to other PCs
• Logging your keystrokes or stealing your sensitive data
• Modifying your system settings
• Running or stopping applications
• Deleting files

This malware description was produced and published using automated analysis of file SHA1 cab9ca5c6769f7980c5b3c1d7c5cf7296eee6757.Symptoms

System changes

The following could indicate that you have this threat on your PC:

• You have these files:
  
  %programfiles%\nsck.ocx
  %programfiles%\winmgmt.exe
  %windir%\assembly\nativeimages_v2.0.50727_32\temp\zape.tmp\microsoft.build.utilities.v3.5.dll
  %windir%\assembly\nativeimages_v2.0.50727_32\temp\zapf.tmp\microsoft.build.visualjsharp.dll

Last update 22 May 2014

 

TOP