https://www.botnets.fr/index.php?action=history&feed=atom&title=MSRT_April_2012%3A_Win32%2FClaretoreMSRT April 2012: Win32/Claretore - Revision history2026-10-24T03:00:37ZRevision history for this page on the wikiMediaWiki 1.43.11https://www.botnets.fr/index.php?title=MSRT_April_2012:_Win32/Claretore&diff=2173&oldid=prevEric.freyssinet: 1 revision imported2015-02-07T14:24:19Z<p>1 revision imported</p>
<table style="background-color: #fff; color: #202122;" data-mw="interface">
<col class="diff-marker" />
<col class="diff-content" />
<col class="diff-marker" />
<col class="diff-content" />
<tr class="diff-title" lang="en">
<td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">← Older revision</td>
<td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">Revision as of 14:24, 7 February 2015</td>
</tr><tr><td colspan="4" class="diff-notice" lang="en"><div class="mw-diff-empty">(No difference)</div>
</td></tr>
<!-- diff cache key wiki:diff:1.41:old-2172:rev-2173 -->
</table>Eric.freyssinethttps://www.botnets.fr/index.php?title=MSRT_April_2012:_Win32/Claretore&diff=2172&oldid=prevEric.freyssinet at 13:31, 9 December 20122012-12-09T13:31:06Z<p></p>
<p><b>New page</b></p><div>{{Publication<br />
|Image=MSRT April 2012 Claretore.jpg<br />
|Link=http://blogs.technet.com/b/mmpc/archive/2012/04/10/msrt-april-2012-win32-claretore.aspx blog.technet.com<br />
|Author=Tim Liu<br />
|NomRevue=Threat Research & Response Blog<br />
|Date=10 Apr 2012<br />
|Editor=Microsoft<br />
|Year=2012<br />
|Malware=Claretore<br />
|Abstract=We included three threat families in the April edition of the Microsoft Malicious Software Removal Tool - Win32/Claretore, Win32/Bocinex and Win32/Gamarue. In this post, we discuss Win32/Claretore.<br />
<br />
The earliest reported variant in this family can be traced back to November 2011. Claretore is a trojan that injects itself into running processes to intercept browser traffic and redirect the browser to an attacker-defined URL. It also sends information about the affected computer to a remote server.<br />
<br />
The installation and preservation mechanism employed by Claretore is not new but it is aggressive. Claretore drops copy of itself to the user profile's folder and the temp folder, and removes the original copy of the malware. The registry is modified to execute Claretore at every Windows start.<br />
}}</div>Eric.freyssinet