Defend what you create

Other Resources

Close

Library
My library

+ Add to library

Contact us
24/7 Tech support | Rules regarding submitting

Send a message

Your tickets

Profile

Win32.HLLW.Autoruner3.2098

Added to the Dr.Web virus database: 2020-03-20

Virus description added:

Technical Information

Malicious functions
Searches for registry branches where third party applications store passwords
  • [<HKCU>\Software\LinasFTP\Site Manager]
  • [<HKCU>\Software\FlashPeak\BlazeFtp\Settings]
  • [<HKCU>\Software\Ghisler\Total Commander]
  • [<HKCU>\Software\mIRC]
  • [<HKCU>\Software\Far\Plugins\FTP\Hosts]
  • [<HKCU>\Software\Far2\Plugins\FTP\Hosts]
  • [<HKCU>\Software\VanDyke\SecureFX]
  • [<HKLM>\Software\NCH Software\Fling\Accounts]
  • [<HKCU>\Software\NCH Software\Fling\Accounts]
  • [<HKLM>\Software\NCH Software\ClassicFTP\FTPAccounts]
  • [<HKCU>\Software\NCH Software\ClassicFTP\FTPAccounts]
  • [<HKCU>\Software\SimonTatham\PuTTY\Sessions]
  • [<HKLM>\Software\SimonTatham\PuTTY\Sessions]
  • [<HKCU>\Software\Martin Prikryl]
  • [<HKLM>\Software\Martin Prikryl]
  • [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook]
Reads files which store third party applications passwords
  • %LOCALAPPDATA%\chromium\user data\default\web data
  • %APPDATA%\opera software\opera stable\login data
  • %APPDATA%\thunderbird\profiles.ini
Modifies file system
Creates the following files
  • %PROGRAMDATA%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\policy.vpol
  • %PROGRAMDATA%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\3ccd5499-87a8-4b10-a215-608888dd3b55.vsch
  • %PROGRAMDATA%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\2f1a6504-0641-44cf-8bb5-3612d865f2e5.vsch
  • %LOCALAPPDATA%\microsoft\vault\4bf4c442-9b8a-41a0-b380-dd4a704ddb28\policy.vpol
  • %APPDATA%\869fe8\8d252e.hdb
  • %APPDATA%\869fe8\8d252e.lck
Deletes the following files
  • %APPDATA%\869fe8\8d252e.lck
Substitutes the following files
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2922372159-162323534-3872807762-1001\f58155b4b1d5a524ca0261c3ee99fb50_597d9903-ea81-40e6-803a-40d3e5258fa4
Moves itself
  • from <Full path to file> to %APPDATA%\869fe8\8d252e.exe
Network activity
Connects to
  • 'eu###ach.com':80
TCP
HTTP POST requests
  • http://eu###ach.com/cream/five/fre.php
UDP
  • DNS ASK eu###ach.com

The Russian developer of Dr.Web anti-viruses

Doctor Web has been developing anti-virus software since 1992

Dr.Web is trusted by users around the world in 200+ countries

The company has delivered an anti-virus as a service since 2007

24/7 tech support

© Doctor Web
2003 — 2020

Doctor Web is the Russian developer of Dr.Web anti-virus software. Dr.Web anti-virus software has been developed since 1992.

2-12А, 3rd street Yamskogo polya, Moscow, Russia, 125040