• Home
• >Threat Encyclopaedia
• >Descriptions
• > Win32/Yebot.AC

Short description

The trojan serves as a backdoor. It can be controlled remotely. The trojan is usually a part of other malware.

Installation

The trojan does not create any copies of itself.

The trojan may create the following files:

The trojan may set the following Registry entries:

This causes the trojan to be executed on every system start.

The trojan modifies the following file:

Malicious code is executed every time an infected DLL is loaded.

The trojan creates and runs a new thread with its own program code within the following processes:

The following Registry entries are set:

The following services are disabled:

A string with variable content is used instead of %variable1-2% .

Information stealing

Win32/Yebot.AC is a trojan that steals sensitive information.

The trojan collects information used to access certain sites.

The following programs are affected:

The trojan can send the information to a remote machine.

Other information

The trojan serves as a backdoor. It can be controlled remotely.

The trojan acquires data and commands from a remote computer or the Internet.

The trojan contains a list of (3) URLs. The HTTP protocol is used.

It can execute the following operations:

The trojan opens TCP port 8000 . A proxy is listening there.

The trojan keeps various information in the following Registry key:

A string with variable content is used instead of %variable% .

The trojan may attempt to delete all files on the local drives.

The trojan may cause the operating system to crash.

The trojan hooks the following Windows APIs:

• Contact |
• Privacy |
• Legal Information |
• Sitemap