The Revenge Trojan is a dangerous weapon used against computer users worldwide. Ele infecta principalmente através de instaladores de software infectados. Nosso artigo dá uma visão geral do seu comportamento de acordo com as amostras recolhidas e os relatórios disponíveis, Também pode ser útil na tentativa de remover o vírus.
|Pequena descrição||The Revenge Trojan is a computer virus that is designed to silently infiltrate computer systems.|
|Os sintomas||As vítimas podem não sentir quaisquer sintomas aparentes de infecção.|
|distribuição Método||Vulnerabilidades de software, Instalações freeware, pacotes integrados, Scripts e outros.|
|Ferramenta de detecção|| See If Your System Has Been Affected by Revenge Trojan |
Remoção de Malware Ferramenta
|Experiência de usuário||Participe do nosso Fórum to Discuss Revenge Trojan.|
Revenge Trojan – Distribution Methods
The Revenge Trojan has been spotted in a recent attack campaign. An unknown hacker collective is behind the ongoing attacks, at the moment there is no information about their identity. The captured samples were identified as malware through one of the most common intrusion mechanisms — documentos infectados. The virus installation code is made part of macros that are embedded in the payload documents, they can be of any one of the popular types: documentos de texto, Planilhas, apresentações e bancos de dados. Once they are opened by the victim users a prompt will appear asking the victims to enable the content. The window will usually state that this is required in order to view correctly the files.
What’s more dangerous is that other similar tactics can be employed as well. One of the common cases is when the hackers embed the virus installation instructions in software setup files. They target applications that are popularly downloaded by end users such as system utilities, suites criatividade, de produtividade de escritório e aplicativos e etc.
Both the virus files themselves and these two payload types are usually spread through methods that can infect thousands of users at once. There are several methods such as the following:
- Email SPAM Messages — The hackers can craft phishing emails that appear notifications as being sent by legitimate services. This is done by using their own design layout and text body contents. The fake email phishing messages will link the files in text links or interactive contents. Alternatively they can be directly attached to the messages.
- Websites maliciosos — A related strategy is to create web pages that imitate legitimate services, portais de download, páginas de destino e etc. They are hosted on similar sounding domain names and in some cases utilizing stolen or hacker-generated security certificates.
- File-Sharing Sites — Both the standalone files and infected payloads are widely available on networks like BitTorrent where both legitimate and pirate content is freely shared across Internet users.
- Seqüestradores de navegador — Dangerous web browser plugins can be be made by the criminals that are made compatible with the most popular web browsers and uploaded to the relevant repositories. They are accompanied by fake user reviews and stolen or hacker-made developer credentials in order to confuse the victims into thinking that the extension is safe. Their descriptions will promise the addition of new features or performance optimizations.
Other tactics can additionally be used in forthcoming attacks and upcoming versions of the Revenge Trojan.
Revenge Trojan – Detailed Description
The Revenge Trojan appears to be an original creation which doesn’t use any code snippets from previous threats. At the time of writing this article there is information about the identity of the group behind the ongoing attacks. We presume that the threat is modular in nature and that various modules can be added to it.
The captured Revenge Trojan instance appears to launch a main engine which connects to a hacker-controlled server and allows the criminal operators to spy on the victims. Through this secure connection they have the ability to take over control of the affected machines, steal their data and carry out all sorts of malicious actions.
A PowerShell-based script is launched which allows all sorts of components to be added. Trojans such as this one usually all include a certain set of common behavior patterns. Uma lista deles é o seguinte:
- Recuperação de informação — The engine can be programmed to extract sensitive information that can be used to generate an unique ID that is specfiic to each individual computer. This is done by an algorithm that takes its input parameters from data sets such as the parts list of the installed hardware components, Configurações do Usuário, regional preferences and other related metrics. The other dangerous mechanic used by Trojans is the exposure of personal information which is done by programming the strings to look for strings that contain directly reveal the victims. Common ones include their name, endereço, número de telefone, interesses e quaisquer credenciais da conta armazenados. If the Trojan interacts with the Windows Volume Manager it can also search the removable storage devices and available network shares. The obtained data sets can be used for various crimes including identity theft, chantagem e abuso financeiro.
- Bota opções de modificação — A popular mechanism that is made part of most Trojans, possibly including future Revenge Trojan variants, is the ability to modify the boot options and configuration files that will set it to automatically start once the computer is powered on. This can also disable most manual user recovery guides as they depend on access to recovery boot menus.
- Alterações de Registro do Windows — The Trojan module is capable of accessing the Registry records not only to create strings for itself but also to modify existing ones. If values that are used by the operating system are affected then the victim users will be unable to access certain services and may experience serious performance issues. Changes to strings used by third-party applications can lead to unexpected errors.
- Remoção de dados sensíveis — The engine can be programmed to locate and delete sensitive files that can seriously disrupt the usual recovery procedure. This is done by targeting System Restore Points, backups, As cópias de sombra de volume e etc. In this case the victims will need to se a combination of a professional-grade anti-spyware utility and data recovery program.
- Additional Payloads Delivery — The Revenge Trojan can be instructed to insert other malicious threats on the compromised machines.
Future Revenge Trojan campaigns can be instructed to carry out other actions as configured by the hackers.
Remove Revenge Trojan
Se o seu sistema de computador foi infectado com o Revenge Trojan, você deve ter um pouco de experiência na remoção de malware. Você deve se livrar deste Trojan o mais rápido possível antes que ele possa ter a chance de se espalhar ainda mais e infectar outros computadores. Você deve remover o Trojan e siga o passo-a-passo guia de instruções fornecido abaixo.
Nota! Seu sistema de computador pode ser afetado por Revenge Trojan e outras ameaças.
Analise o seu PC com SpyHunter
SpyHunter é uma ferramenta de remoção de malware poderoso projetado para ajudar os usuários com a análise de segurança do sistema em profundidade, detecção e remoção de Revenge Trojan.
Tenha em mente, esse scanner de SpyHunter é apenas para detecção de malware. Se SpyHunter detecta malware em seu PC, você terá de comprar ferramenta de remoção de malware da SpyHunter para remover as ameaças de malware. Ler nossa SpyHunter 5 Reveja. Clique nos links correspondentes para verificar do SpyHunter EULA, Política de Privacidade e Ameaça Critérios de Avaliação.