Win32/PSW.Steam [Threat Name] go to Threat

Win32/PSW.Steam.NBC [Threat Variant Name]

Category trojan
Size 111104 B
Detection created Jun 24, 2014
Detection database version 10051
Aliases Trojan-PSW.Win32.Mist.a (Kaspersky)
  Trojan.Zbot (Symantec)
Short description

Win32/PSW.Steam.NBC is a trojan that uploads files to a remote server. The trojan is probably a part of other malware.

Installation

The trojan does not create any copies of itself.

Information stealing

The trojan gathers information related to the following services:

  • SteamGuard

The trojan collects the following files:

  • C:\­Program Files\­Steam\­ssfn*
  • %steamfolder%\­ssfn*

Instead of %steamfolder% , the value(s) are taken from the following Registry entry:

  • [HKEY_LOCAL_MACHINE\­SOFTWARE\­Valve\­Steam\­InstallPath]

The trojan attempts to send the collected files to a remote machine.


The trojan contains a URL address. The HTTP protocol is used.


Other information

The trojan displays a fake error message:

The trojan then removes itself from the computer.

Please enable Javascript to ensure correct displaying of this content and refresh this page.