Backdoor:Win32/Hanove.A

Backdoor:Win32/Hanove.A is a trojan that allows unauthorized access and control of an affected computer.

Backdoor:Win32/Hanove.A modifies the following registry entries to ensure that its copy executes at each Windows start:

Adds value: "WindowsRemoteSecurity"
With data: "<malware file>.exe"
To subkey: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Adds value: "WindowsRemoteSecurity"
With data: "<malware file>.exe"
To subkey: HKCU\Software\Microsoft\windows\currentversion\run

The malware creates the following files on an affected computer:

Backdoor:Win32/Hanove.A allows unauthorized access and control of an affected computer. An attacker can perform any number of different actions on an affected computer using Backdoor:Win32/Hanove.A. This could include, but is not limited to, the following actions:

This malware description was produced and published using our automated analysis system's examination of file SHA1 42c26766d16cb9c21c3a95bac84b88bc1469d7c5.