a variant of Win32/Fusing.CF also known as Trojan.GenericKD.1761213, Trojan.Staser!, Trojan.Win32.Fusing.bCF.
Malware Analysis of a variant of Win32/Fusing.CF – USYBTND.EXE
Created files:
%Program Files%\Windows NT\Usybtnd.exe
Autostart registry keys:
HKLM\System\CurrentControlSet\Services\Wsmnnh oryqjhhn\ImagePath: “%Program Files%\Windows NT\Usybtnd.exe”
HKLM\System\CurrentControlSet\Services\Wsmnnh oryqjhhn\DisplayName: “Cwykqa yagasscc”
Detected by UnHackMe:
USYBTND.EXE
Default location: %PROGRAM FILES%\WINDOWS NT\USYBTND.EXE
Dropper hash(md5): ab5dab9b95b114dee0fb060dff5b9628