Backdoor.Win32.Mokes

Malware in this family (which is also known as “Smoke loader”) is distributed by criminals with the help of the Trojan.Win32.Cutwail spam bot. When run on the user’s computer, malware in the Backdoor.Win32.Mokes family downloads other malware (such as Trojan-Ransom.Win32.Cryptodef, also known as Cryptowall). Smoke loader is notable for its modular architecture, which enables the malware to gain additional features.

These modules make it possible for the malware to perform the following actions on an infected computer:

• Spoof the Hosts file (located in the %SystemRoot%system32driversetchosts folder of the infected computer).
• Steal user passwords.
• Intercept data entered by the user in a web browser.
• Install shell code on the user’s computer.

Top 10 countries with most attacked users (% of total attacks)

* Percentage of all unique Kaspersky users attacked by this malware