Trojan.Lefimy.A

The detection of Trojan.Lefimy.A on your system indicates a potential security threat that requires immediate attention. This Trojan-type threat can compromise your computer's security and put your personal data at risk. It is essential to understand the nature of this threat and take prompt action to remove it from your system.

What Is Trojan.Lefimy.A?

Trojan.Lefimy.A is a type of malware that can infiltrate your computer without your knowledge or consent. It is designed to remain hidden and can be difficult to detect, making it a significant threat to your system's security. Trojans like Trojan.Lefimy.A can be used to steal sensitive information, install additional malware, or provide unauthorized access to your computer.

How Trojan.Lefimy.A Operates

Trojan.Lefimy.A operates by exploiting vulnerabilities in your system or using social engineering tactics to trick you into installing it. Once installed, it can communicate with its command and control servers to receive instructions and transmit stolen data. It may also attempt to download and install additional malware or create backdoors to allow remote access to your computer.

Symptoms of Infection

Identifying the symptoms of a Trojan.Lefimy.A infection can be challenging, as it is designed to remain stealthy. However, you may notice unusual system behavior, such as slow performance, frequent crashes, or unfamiliar programs running in the background. You may also receive unexpected pop-ups, experience unusual network activity, or find unfamiliar files or folders on your computer.

• Unexplained changes to your system settings or configuration
• Unfamiliar icons or shortcuts on your desktop or taskbar
• Increased CPU usage or disk activity
• Difficulty accessing certain files or folders

How to Remove Trojan.Lefimy.A

1. Boot your computer in Safe Mode with Networking to prevent the malware from loading and to allow you to download and install removal tools.
2. Use a reputable anti-malware tool, such as SpyHunter, to perform a full scan of your system and detect any malware or other threats.
3. Uninstall any suspicious programs or applications that you do not recognize or that were installed without your consent.
4. Reset your web browsers, including Chrome, Firefox, and Edge, to their default settings to remove any malicious extensions or add-ons.
5. Reboot your computer and perform another full scan with your anti-malware tool to ensure that the threat has been completely removed.

Conclusion

Removing Trojan.Lefimy.A from your system requires a combination of technical expertise and caution. By following the steps outlined above and using reputable anti-malware tools, you can help to ensure the security of your computer and protect your personal data. It is essential to remain vigilant and to regularly scan your system for malware to prevent future infections. Remember to always use caution when downloading software or clicking on links from unfamiliar sources, and to keep your operating system and security software up to date to prevent exploitation of known vulnerabilities.

Analysis Report

General information

Family Name:	Trojan.Lefimy.A
Signature status:	No Signature

Known Samples

i

Known Samples

This section lists other file samples believed to be associated with this family.

MD5: 0d853b382746e7b22d99baeb1cc4d9fa SHA1: e58eaea35d749d454307be8f9014f70bf8f3924e SHA256: 2AF92C02377ACACA3C387D8A807A56BB29B1B223F1197EC84E7EB965BB21CD0B File Size: 1.74 MB, 1737216 bytes

MD5: 47b1f6dbde1d3570cf5b26adccdd4af5 SHA1: 9d2eea3dbb61d4bb28ac0788fd3edf11fb887688 SHA256: A9763A7DAA98B1D3CBE9156BA5535DD23355DFBFF63EF1174EF7FAE95B353DBA File Size: 494.08 KB, 494080 bytes

MD5: 3bc4f29c441a8429abd5f43c686fa1b7 SHA1: dc5cf69cbf9e6b1891d68671a710a806f26773da SHA256: 27D18C32AEF965BAF52D3672C3E1CD639E3FFE10D9EF271788F7D3859C9B702A File Size: 220.16 KB, 220160 bytes

MD5: af53a35c5b12746d8c521c5b0926c0cf SHA1: 70fa61a5fd8175ca65736e6e721d97f3ae2970d3 SHA256: 91DE78011ED3463BF4F517FB2F5CE955B18B79BF1F02397E2E26845580CCA6CA File Size: 4.21 MB, 4213760 bytes

MD5: ebe2d6bd97d3b72d8ae04a25afbdebde SHA1: c69308a4b8206c09d07e1bbcc0399d2dea27089d SHA256: 5E03682DB635978B2746BAEABE92BCA3057C68F76DD9BB9C1747EEA279928F02 File Size: 1.74 MB, 1736192 bytes

Show More

MD5: e4035b23de5df525b4378a8e65d65548 SHA1: f6a8c8276cca8706dfdc9225996dcb4581260695 SHA256: F4FF06BC6BC8429D52E026B9CD454E3865C2D430451F9414A46F46DB13899477 File Size: 2.51 MB, 2508800 bytes

Windows Portable Executable Attributes

i

Windows Portable Executable Attributes

This section lists file attributes found within family samples. These attributes are extracted from the files’ Windows PE (Portable Executable) specification and various system flags. Portable Executable Attributes give malware researchers insight into a file’s functionality, executable details, platform and runtime environment.

• File doesn't have "Rich" header
• File doesn't have debug information
• File doesn't have exports table
• File doesn't have relocations information
• File doesn't have security information
• File has been packed
• File has TLS information
• File is 32-bit executable
• File is either console or GUI application
• File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)

Show More

• File is Native application (NOT .NET application)
• File is not packed
• IMAGE_FILE_DLL is not set inside PE header (Executable)
• IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

File Icons

i

File Icons

This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.

Windows PE Version Information

i

Windows PE Version Information

This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.

Name	Value
Build Date	14.01.2009
Company Name	Bank's Soft Systems
Company Name	Synaptics
File Description	BSS system file Synaptics Pointing Device Driver
File Version	3.17.3.1020 1.0.0.4
Legal Copyright	(C) 1998-2009 Bank's Soft Systems
Product Language	RUSSIAN
Product Name	DBO Bank-Client
Product Name	Synaptics Pointing Device Driver
Product Version	3.17.3.1020 1.0.0.0
Sale Release	17.3
V S_ Version	3

File Traits

• No Version Info
• packed
• x86

Files Modified

i

Files Modified

This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.

File	Attributes
\device\namedpipe\gmdasllogger	Generic Write,Read Attributes
c:\bs-internetclient\bssetuplog\bssetup.log	Generic Write,Read Attributes
c:\programdata\synaptics	Synchronize,Write Attributes
c:\programdata\synaptics\rcxfc28.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\programdata\synaptics\synaptics.exe	Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete,LEFT 262144
c:\programdata\synaptics\synaptics.exe	Synchronize,Write Attributes
c:\programdata\synaptics\synaptics.exe	Synchronize,Write Data
c:\users\user\appdata\local\temp\7vdq5li.ini	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\roaming\winsl	Synchronize,Write Attributes
c:\users\user\appdata\roaming\winsl\l5\5\2026	Generic Read,Write Data,Write Attributes,Write extended,Append data

Show More

c:\users\user\downloads\._cache_f6a8c8276cca8706dfdc9225996dcb4581260695_0002508800	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\downloads\._cache_f6a8c8276cca8706dfdc9225996dcb4581260695_0002508800	Synchronize,Write Attributes

Registry Modifications

i

Registry Modifications

This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.

Key::Value	Data	API Name
HKCU\software\microsoft\windows\currentversion\explorer::slowcontextmenuentries	`$�!�:i��+00�� �Gs]XM���"�2� �FX D�':D��exA-��LG=�A��J� �C �	RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\explorer::slowcontextmenuentries	`$�!�:i��+00�� �Gs]XM���"�2� �FX D�':D��exA-����n����<���	RegNtPreCreateKey
HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75	Ll ! �v�Z������(�1`1�1HO@V�A��H[u_�zk`k�qw�n{b��P���� �����������Rc�m�Ù�����$ �8წ���V�&M�=�S/�B1_T�Vw��R���%�������AE��D��&��$���L @ �O�	RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::synaptics pointing device driver	C:\ProgramData\Synaptics\Synaptics.exe	RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\explorer::slowcontextmenuentries	`$�!�:i��+00�� �Gs]XM���"�2� �FX ]T�� �B�����w�����n����<���	RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::proxybypass		RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::intranetname		RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::uncasintranet		RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::autodetect		RegNtPreCreateKey
HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc3475	陌 ȁ 獖}	RegNtPreCreateKey

Show More

HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75	Ml ' �v�Z��������(�1`1�1HO@V�A��H[u_�zk`k�qw�n{b��P���� ��7 �M�����������Rc�m�Ù��IV����$ �8წ���V�&M�(! ��j� �=�S/�B1_T�Vw�`�V �R���%�������AE��D��&��$���L	RegNtPreCreateKey
HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75	Nl ( �v�Z��������(�1`1�1HO@V�A��H[u_�zk`k�qr�7 w�n{b��P���� ��7 �M�����������Rc�m�Ù��IV����$ �8წ���V�&M�(! ��j� �=�S/�B1_T�Vw�`�V �R���%�������AE��D��&��$���	RegNtPreCreateKey

Windows API Usage

i

Windows API Usage

This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.

Category	API
Anti Debug	IsDebuggerPresent
User Data Access	GetUserObjectInformation
Service Control	OpenSCManager
Process Shell Execute	ShellExecuteEx
Process Manipulation Evasion	NtUnmapViewOfSection
Network Winsock2	WSAStartup WSAttemptAutodialName
Network Winhttp	WinHttpOpen
Network Wininet	InternetOpen InternetOpenUrl InternetReadFile
Network Winsock	bind closesocket gethostbyname getsockname socket

Shell Command Execution

i

Shell Command Execution

This section lists Windows shell commands that are run by the samples in this family. Windows Shell commands are often leveraged by malware for nefarious purposes and can be used to elevate security privileges, download and launch other malware, exploit vulnerabilities, collect and exfiltrate data, and hide malicious activity.

runas c:\users\user\downloads\._cache_f6a8c8276cca8706dfdc9225996dcb4581260695_0002508800

runas C:\ProgramData\Synaptics\Synaptics.exe InjUpdate