.: PS-Ware IE PS 1.8.16 :.
By Impostor
::actions
Additional Details
- From: Iran
- Coded by: Impostor
- Version: PS-Ware IE PS 1.8.16
- Coded in: Visual Basic
- Family: PS-Ware IE PS 1.8.16
- Category: Information Stealer
MegaSecurity Notes
Server: dropped files: c:\WINDOWS\system32\regm.dat Size: 0 bytes c:\WINDOWS\system32\regsvr.exe Size: 50,176 bytes c:\WINDOWS\system32\WinIPV9.dll Size: 11,828 bytes c:\WINDOWS\system32\drivers\Tioner.exe Size: 50,176 bytes startup: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "regsvr.exe " data: C:\WINDOWS\System32\regsvr.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{z6B2445-1963-9142-A0DB-DBDB9E15FB9z} "StubPath" data: C:\WINDOWS\System32\drivers\Tioner.exe sysdir tested on Windows XP October 30, 2006
URL's and mails were automatically redacted (filtered) for reader's safety. However the filter is not perfect and can't find all harmful elements. If you find something dangerous including file link, website, mail address, profanity... contact me immediately at sub7crew@protonmail.com, thank you in advance.