Prevx Research Division
SISTEMA.EXE
Information StealerFree PC Cleanup from Webroot
Use Webroot SecureAnywhere to remove SISTEMA.EXE.
"Just when you thought it couldn't get any better or faster. The Webroot scanning engine is 'high octane' with a hidden nitrous oxide system. Bravo!!!" W. Lodzinski, SecureAnywhere User
Associated Malware Groups
The unsafe files using this name are associated with the malware groups:
- Information Stealer
- System Back Door
File Behavior
SISTEMA.EXE has been seen to perform the following behavior:
- Writes to another Process's Virtual Memory (Process Hijacking)
- Executes a Process
- This process creates other processes on disk
- This Process Deletes Other Processes From Disk
- The Process is packed and/or encrypted using a software packing process
- This Process is a file infector which modifies program files to include a copy of the infection
- Injects code into other processes
- Uses DNS to retrieve the IP address for web sites
SISTEMA.EXE has been the subject of the following behavior:
- Added as a Registry auto start to load Program on Boot up
- Executed as a Process
- Created as a process on disk
- Has code inserted into its Virtual Memory space by other programs
- Copied to multiple locations on the system
Country Of Origin
The filename SISTEMA.EXE was first seen on Sep 11 2007 in the following geographical regions of the Webroot community:
- Portugal on Sep 11 2007
- Uruguay on Mar 14 2008
- Brazil on Mar 20 2008
- Spain on Dec 30 2008
- Peru on Feb 24 2010
- The United Kingdom on Feb 24 2010
- Mexico on May 7 2012
File Name Aliases
SISTEMA.EXE can also use the following file names:
- SISTEMA.EXE( 1)
- 31184713.EXE
- 86673338.EXE
- 81035151.EXE
- 63449705.EXE
- 48107898.EXE
Filesizes
The following file size has been seen:
- 66,560 bytes
- 25,146,259 bytes
- 1,659,904 bytes
- 1,049,703 bytes
- 184,320 bytes
- 3,227,648 bytes
- 5,282,789 bytes
File Type
The filename SISTEMA.EXE is used by multiple object types including executable programs,objects.
File Activity
One or more files with the name SISTEMA.EXE creates, deletes, copies or moves the following files and folders:
- create folder C:\WINDOWS\system32\XP\
- Copies filec:\8887228.exe to c:\windows\system32\xp\sistema.exe
- Creates c:\sistema.exe
- Creates c:\windows\system32\xp\logs.dat
Network Activity
One or more files with the name SISTEMA.EXE performs the following network events:
- DNS Lookup127.0.0.1 127.0.0.1
- DNS Lookup190.166.188.64 habbosistema.sytes.net
- DNS Lookup œ
Website Activity
One or more files with the name SISTEMA.EXE interacts with the following web sites and pages. Web addresses have been deliberately modified to prevent unintentional use.
- TCP:127.0.0.1:82 Port:15
- TCP:190.166.188.64:82 Port:15
- TCP:190.166.188.64:82 Port:15
- TCP:127.0.0.1:81 Port:20
- TCP:190.166.188.64:81 Port:20
Help the Webroot Community to fight cyber crime
We are always looking for ways to improve the quality and speed of research to help us protect you from malicious software and cyber crime.
PCMag.com Editors' Choice Award Logo is a trademark of Ziff Davis Publishing Holdings Inc. Used under license.