Troj/Hasum-A is a Trojan for the Windows platform.
Troj/Hasum-A may download and run files from a remote server, may open the default browser to pre-specified webapges, and may monitor computer usage.
The following registry entries are created to run code exported by the Trojan DLL on startup:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\st3i
DLLName
<pathname of the Trojan executable>
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\st3i
startup
WACLEventStartup
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ SharedTaskScheduler
{B212D577-05B7-4963-911E-4A8588160DFA}
st3i
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\st3
DLLName
<pathname of the Trojan DLL>
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\st3
startup
WACLEventStartup
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ SharedTaskScheduler
{1B68470C-2DEF-493B-8A4A-8E2D81BE4EA5}
z
Troj/Hasum-A is registered as a COM object, creating registry entries under:
HKCR\CLSID\{B212D577-05B7-4963-911E-4A8588160DFA}
HKCR\CLSID\{1B68470C-2DEF-493B-8A4A-8E2D81BE4EA5}