Win32/Qhost.Banker [Threat Name] go to Threat

Win32/Qhost.Banker.PW [Threat Variant Name]

Category	trojan
Size	81408 B
Aliases	Trojan-Downloader.Win32.Betload.aaa (Kaspersky)
	Trojan.Hosts.40077 (Dr.Web)

Win32/Qhost.Banker.PW is a trojan that prevents access to certain web sites and reroutes traffic to certain IP addresses.

When executed, the trojan creates the following folder:

The following file is dropped in the same folder:

The file is then executed.

A string with variable content is used instead of %variable1-2% .

The trojan may create the following files:

The file is then executed.

Win32/Qhost.Banker.PW is a trojan that prevents access to certain web sites and reroutes traffic to certain IP addresses.

The trojan modifies the following file:

The trojan writes the following entries to the file:

The trojan executes the following commands: