Home/ Spyware Encyclopedia / PSW.Mapler | |  | PSW.Mapler Technical Details |  |
| | Category |  | PSW | | Discovered | | 3/13/2008 4:03:00 PM | | Modified | | 3/14/2008 10:36:00 AM | | Threat Level | | Critical | | Description | | This family of Trojans steal passwords, normally system passwords from victim machines. They search for system files which contain confidential information such as passwords and Internet access telephone numbers and then send this information to an email address coded into the body of the Trojan. The ‘master’ or user of the illegal program will then retrieve and misuse this information..Most common behavior:1. Ask for password using fake window2. Change ICQ, MSN, AOL configuration3.Get cached Windows passwords. | | Summary | | The hosts file was updated with the following url-to-ip mappings: n/a
The following http urls were started: n/a
Generated smtp traffic: n/a
Connection(s) established with remote IRC Server: n/a
The following hidden entries created: n/a
The following internet connection was established: n/a
| | When the PSW is executed, it creates the following files: | | Name | Version | Publisher | Signature (MD5) | File Size (in Bytes) | | ..\msinfo\ieupdate.dll | | | 950a6490075c607493da91e2aa9dbdf8 | 56432 | | ..\msinfo\infshell.dll | | | 6e9fbdb49c74fb4c5203e266499c0576 | 41573 | | ..\msinfo\mapshell.dll | | | 76cec75e5757fc48db54dc15fd806ef0 | 42604 | | ..\msinfo\nexoninfo.dll | | | b717dbf58fe0e8a685288ccae8837513 | 56439 | | ..\7f1c46c1bd7f.dll | | | 3c5ee5572d1c60c5e74e81fbc6f69c55 | 91648 | | ..\7f1c46c1bd7f.exe | | | bd95401ae109f33609ee6e36104fb030 | 118784 | | ..\header.dll | | | 8be09e97a697b2d9ae254d8629092ec6 | 82432 | | ..\ravsprselry.exe | 2000.0.0.0 | | 966b785b2c7845b2ea36d78b0a0be0fc | 28672 | | ..\ravsuteibie.exe | 2000.0.0.0 | | 18e9efccdaf0b3460104458cd0bfeb92 | 13792 | | ..\winsyleabu.dll | | | 36756ac76f8295698e8e3388546de789 | 30 | | ..\header.exe | | | 456c7c32524b10234948270474e8ee9e | 58368 |
|
| | When the PSW is executed, it creates the following Registry entries: | | • | ..\software\classes\clsid\{612fa44f-205c-46d9-8fdb-c6e5464058e1} | | • | ..\software\classes\clsid\{688fa44f-205c-46d9-8fdb-c6e5464058e1} | | • | ..\software\classes\clsid\{8bbeb171-8f86-4669-b664-69b8db553683} | | • | ..\software\classes\clsid\{99beb171-8f86-4669-b664-69b8db553683} | | • | ..\software\microsoft\windows\currentversion\run\"rapdetnly" |
|
|
Recommendation to remove PSW.Mapler |  | Spyware Detector can remove PSW.Mapler, and thousands of other Spyware definitions, automatically and instantly. Click here to download Spyware Detector and scan for free. |
| |
|
| |
| |
| |  | Personalized e-Mail support by our Research Team. You send an "Export Log" report to us, we then add new definition and you eliminate spyware found on YOUR PC in the next Live Update. So, not only do you benefit but the whole community enjoys the feedback.
| |  | Speed up your computer and increase browsing performance by deleting Spyware & Adware | | | Enjoy continuous protection and security with frequent spyware definition updates so you never have to worry about new threats and outdated software. | | | Surf the web with confidence knowing your online activities aren't being tracked, and your confidential data is secure from prying eyes. |
|
|
| |  | | | | | |  | |  Submit a Threat
Submit a threat to be reviewed by our research team
Submit a Threat | |  |
|
|