Home / malware

PDF

TrojanSpy:MSIL/Quoler.A

First posted on 14 October 2015.
Source: Microsoft

Aliases :

There are no other names known for TrojanSpy:MSIL/Quoler.A.

Explanation :

Threat behavior

Installation
This threat can create files on your PC, including:

• \quotation10210.exe

It modifies the registry so that it runs each time you start your PC. For example:

In subkey: HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Sets value: "Quotation10210"
With data: "%CurrentFolder%\quotation10210.exe"


Payload


Collects your sensitive information

This threat can collect your sensitive information without your consent. This can include:

• The keys you press
• The applications you open
• Your web browsing history
• Your credit card information
• Your user names and passwords

It can also imitate a legitimate website to lure you into revealing your sensitive information.

Modifies system settings
This threat can make changes to the way your PC behaves. It can:

• Disable tools for editing the registry
• Disable Task Manager

This malware description was published using automated analysis of file SHA1 9ec454a93e41e59f06bbb5e4c7448c1b6fff14f4.

Symptoms

The following can indicate that you have this threat on your PC:

• You see a file similar to:
  • \quotation10210.exe

• You see registry modifications such as:
  
  • In subkey: HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System
    Sets value: "DisableRegistryTools"
    With data: "0x00000001"
    
    
  • In subkey: HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System
    Sets value: "DisableTaskMgr"
    With data: "0x00000001"
    
    
  • In subkey: HKCU\Software\Microsoft\Windows\CurrentVersion\Run
    Sets value: "Quotation10210"
    With data: "%CurrentFolder%\quotation10210.exe"
    
    

Last update 14 October 2015

 

TOP