Win32/Zacom [Threat Name] go to Threat
Win32/Zacom.G [Threat Variant Name]
| Category | trojan |
| Size | 317377 B |
| Aliases | TR/Dropper.Gen (Avira) |
Short description
The trojan serves as a backdoor. It can be controlled remotely.
Installation
When executed, the trojan copies itself into the following location:
- %temp%\vmcon.exe
In order to be executed on system start, the trojan sets the following Registry entry:
- [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
- "netshare" = "%temp%\vmcon.exe"
The trojan may set the following Registry entries:
- [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
- "mshare" = "%temp%\vmcon.exe"
Other information
The trojan acquires data and commands from a remote computer or the Internet.
The trojan contains a list of (4) URLs. The HTTP protocol is used.
It may perform the following actions:
- download files from a remote computer and/or the Internet
- run executable files
- upload files to a remote computer