Type:<\/strong> Virus <\/p>\n Malware Name(s)<\/strong><\/p>\n <\/p>\n In technical terms, a computer virus such as Pioneer is a type of malware that cannot replicate itself automatically. Viruses can infect all accessible executable files in the computer system, which usually have .exe and .dll extensions. Viruses look for non-infected (host) files during execution, and to replicate, they need to insert their own codes among the host file\u2019s codes. Then, once the infected file is executed, the malicious code will be executed too.<\/p>\n <\/p>\n Virus.Win32.Pioneer targets executable files, Windows services, and system files. During execution, Pioneer generates multiple threads and actively searches for executables and system files to infect. <\/p>\n \u2022 Performance Impact: Significant system slowdowns caused by CPU and RAM consumption from infected services. \u2022 The presence of the following information in the registry:<\/p>\n HKEY_CURRENT_USER\\Software\\Microsoft\\Currentversion\\Internet Settings\\1 HKEY_CURRENT_USER\\Software\\Microsoft\\Currentversion\\Internet Settings\\2 HKEY_CURRENT_USER\\Software\\Microsoft\\Currentversion\\Internet Settings\\3 HKEY_CURRENT_USER\\Software\\Microsoft\\Currentversion\\Internet Settings\\4 <\/p>\n \u2022 Upon execution, Pioneer attempts to connect to these domains, including:<\/p>\n ferrglashing.cc \u2022 After establishing a connection, the malware randomly generates servers that contain MD5-sha1-sha256-tiger128,3 information from the files. Examples include:<\/p>\n gefa-bugin.com \u2022 After connecting to the malicious servers, the malware downloads and installs and executes other malicious software on the victim’s system.<\/p>\n \u2022 Infecting executable files: In order to infect files, it adds a section named vmp0 to the end of the clean file section, then the malware separates a piece of code from the clean file and places it in this additional section, and places the malware code in this section of the clean file. It then changes the address to the program’s EntryPoint address.<\/p>\n \u2022 It searches for services that are not running and starts them after infecting them.<\/p>\n \u2022 Collecting system information and sending them to the malware server: \u2022 It captures the passwords entered through the IE browser by opening the HKEY_LOCAL_MACHINE\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2 registry path and sends them to the malicious server.<\/p>\n \u2022 Terminates some services and open windows randomly.<\/p>\n <\/p>\n It is spread in two ways: <\/p>\n Padvish Antivirus includes a UMP feature as part of its behavioral protection, which prevents infections from portable drives. To protect your system from various types of malware, such as Pioneer malware, which often spread through removable devices, it is recommended to install Padvish Antivirus. This helps ensure your device remains secure and protected from these threats.<\/p>\n","protected":false},"excerpt":{"rendered":" Overview Type: Virus Destruction Level: High Prevalence in Iran: High Malware Name(s) Virus.Win32.Pioneer.a (Padvish) Win32\/Floxif.H (ESET) Virus:Win32\/Floxif.H (Microsoft) Virus.Win32.Pioneer.cz (Kaspersky) What is a virus? In technical terms, a computer virus such as Pioneer is a type of malware that cannot replicate itself automatically. Viruses can infect all accessible executable files in the computer…<\/p>\n","protected":false},"author":27,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[47,82],"tags":[44,83,84],"class_list":["post-1592","post","type-post","status-publish","format-standard","hentry","category-malware","category-virus-malware","tag-malware","tag-virus","tag-pioneer"],"_links":{"self":[{"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/posts\/1592","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/users\/27"}],"replies":[{"embeddable":true,"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/comments?post=1592"}],"version-history":[{"count":8,"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/posts\/1592\/revisions"}],"predecessor-version":[{"id":1600,"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/posts\/1592\/revisions\/1600"}],"wp:attachment":[{"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/media?parent=1592"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/categories?post=1592"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/tags?post=1592"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\nDestruction Level:<\/strong> High
\nPrevalence in Iran:<\/strong> High<\/p>\n\n
What is a virus?<\/h3>\n
What is Pioneer Malware?<\/h3>\n
\nKey objectives include:
\n\u2022 Gathering and sending system details to malicious servers
\n\u2022 Downloading and running malware and other malicious software
\n\u2022 Capturing and transmitting passwords entered through Internet Explorer<\/p>\nTechnical Description<\/h2>\n
Indicators of Compromise (IoCs)<\/h3>\n
\n\u2022 File Modifications: Presence of a vmp0 section appended to infected executable files.
\n\u2022 Suspicious DLL: A file named wsr25zt32.dll in the system, containing data collected from the infected system for transmission to its server.<\/p>\n
\nvaluename = \u201c1609\u201d
\nvaluename = \u201c1406\u201d
\nvaluename = \u201c2103\u201d<\/p>\n
\nvaluename = \u201c1609\u201d
\nvaluename = \u201c1406\u201d
\nvaluename = \u201c2103\u201d<\/p>\n
\nvaluename = \u201c1609\u201d
\nvaluename = \u201c1406\u201d
\nvaluename = \u201c2103\u201d<\/p>\n
\nvaluename = \u201c1609\u201d
\nvaluename = \u201c1406\u201d
\nvaluename = \u201c2103\u201d
\nThese registry values are configured to set a proxy port for unauthorized network access.<\/p>\nDescription of performance<\/h3>\n
\nvilbeaf-pestare.ru
\navpzcheckshop.ru
\nmkz-coffespores.cc
\navpzcheckshop2.ru
\npeshavar-Xtourism.com
\nindirs-factor.ws
\nwww.indirs-factor.ws<\/p>\n
\npykyb-aguh.ru
\ndecub-ydyg.ru<\/p>\n
\nOperating system specifications
\nWindows Product ID
\nDrive C specifications
\n\u2022 Disables protection for protected files and then infects them.
\n\u2022 In one thread, it searches all xml files and randomly deletes some of them.<\/p>\nSpreading method<\/h3>\n
\nThrough removable disks to spread to other systems;
\nBy infecting services, executable files, and Windows to spread to other drives of the infected system.<\/p>\nHow to deal with and clean the system<\/h2>\n