Type<\/strong>: Trojan<\/p>\n Degree of destruction<\/strong>: average<\/p>\n Prevalence<\/strong>: average<\/p>\n Trojans are malware that revealed themselves in the format of an applicable and useful tool. Accordingly, the user downloads and installs them and infects the system without noticing that it is malware. Trojans, usually after installation, act as a backdoor so the hacker can remotely access the victim’s system. For instance, the malware we will analyze here seems to do an applicable and useful job, but it will install an unwanted application on the system.<\/span><\/p>\n Adwind Trojan distributed by using Java instructions and in form of JAR files is able to steal user\u2019s information. Attackers use this malware for collecting and extracting system data as well as remote control of the infected system. Data that this malware will be collected from the victim\u2019s system which is generally from input\/output devices such as a keyboard, mouse, and monitor, and is able to secrete user\u2019s data and interface user\u2019s access to data.<\/p>\n This option let the malware perform an operation without admin validation.<\/p>\nWhat is a Trojan?<\/h3>\n
What is Adwind malware?<\/h3>\n
Technical Explanation<\/h2>\n
Signs of infection<\/h3>\n
\n
\"Appdata%\\Oracle\\bin%\"<\/code><\/p>\n\n
\"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\"<\/code><\/p>\n\n
\"SOFTWARE\\Policies\\Microsoft\\Windows NT\\\\SystemRestore\"<\/code><\/p>\nvalue name: DisableConfig<\/code><\/p>\ndata: 1<\/code><\/p>\n\"SOFTWARE\\Policies\\Microsoft\\Windows NT\\SystemRestore\"<\/code><\/p>\nvalue name: DisableSR<\/code><\/p>\ndata: 1<\/code><\/p>\n\n
\"HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\"<\/code><\/p>\nvalueName: ConsentPromptBehaviorAdmin<\/code><\/p>\ndata: 0<\/code><\/p>\n\n
How to deal with it and disinfect the system<\/h2>\n