BackDoor.BanditoENT.3376

Technical Information

To ensure autorun and distribution:

Infects the following executable files:

<STUBS_DIR>\360tray\360tray.exe
<STUBS_DIR>\lotroclient\lotroclient.exe
<STUBS_DIR>\InphaseNXD\InphaseNXD.exe
<STUBS_DIR>\httplook\httplook.exe
<STUBS_DIR>\gw\gw.exe
<STUBS_DIR>\ge\ge.exe
<STUBS_DIR>\gc\gc.exe
<STUBS_DIR>\elementclient\elementclient.exe
<STUBS_DIR>\dnf\dnf.exe
<STUBS_DIR>\dekaron\dekaron.exe
<STUBS_DIR>\ccapp\ccapp.exe
<STUBS_DIR>\cabalmain\cabalmain.exe
<STUBS_DIR>\safari\safari.exe
<STUBS_DIR>\opera\opera.exe
<STUBS_DIR>\iexplore\iexplore.exe
<STUBS_DIR>\firefox\firefox.exe
<STUBS_DIR>\chrome\chrome.exe
<STUBS_DIR>\webmoney\webmoney.exe
<STUBS_DIR>\wclnt\wclnt.exe
<STUBS_DIR>\UniStream\UniStream.exe
<STUBS_DIR>\translink\translink.exe
<STUBS_DIR>\tiny\tiny.exe
<STUBS_DIR>\startclient7\startclient7.exe
<STUBS_DIR>\sgbclient\sgbclient.exe
<STUBS_DIR>\rclient\rclient.exe
<STUBS_DIR>\oncbcli\oncbcli.exe
<STUBS_DIR>\magent\magent.exe
<STUBS_DIR>\maplestory\maplestory.exe
<STUBS_DIR>\MCAGENT\MCAGENT.EXE
<STUBS_DIR>\Mir3Game\Mir3Game.exe
<STUBS_DIR>\putty\putty.exe
<STUBS_DIR>\ntvdm\ntvdm.exe
<STUBS_DIR>\javaw\javaw.exe
<STUBS_DIR>\java\java.exe
<STUBS_DIR>\YahooMessenger\YahooMessenger.exe
<STUBS_DIR>\wsm\wsm.exe
<STUBS_DIR>\trillian\trillian.exe
<STUBS_DIR>\skype\skype.exe
<STUBS_DIR>\qip\qip.exe
<STUBS_DIR>\pidgin\pidgin.exe
<STUBS_DIR>\msnmsgr\msnmsgr.exe
<STUBS_DIR>\msn6\msn6.exe
<STUBS_DIR>\ICQ\ICQ.exe
<STUBS_DIR>\miranda32\miranda32.exe
<STUBS_DIR>\googletalk\googletalk.exe
<STUBS_DIR>\zlclient\zlclient.exe
<STUBS_DIR>\ybclient\ybclient.exe
<STUBS_DIR>\wow\wow.exe
<STUBS_DIR>\woool\woool.exe
<STUBS_DIR>\winbaram\winbaram.exe
<STUBS_DIR>\TwelveSky2\TwelveSky2.exe
<STUBS_DIR>\sro_client\sro_client.exe
<STUBS_DIR>\so3d\so3d.exe
<STUBS_DIR>\smc\smc.exe
<STUBS_DIR>\RagFree\RagFree.exe
<STUBS_DIR>\Ragexe\Ragexe.exe
<STUBS_DIR>\__cd75efb816b2cc__\__cd75efb816b2cc__.exe
<STUBS_DIR>\loadmain\loadmain.exe
<STUBS_DIR>\kb_cli\kb_cli.exe
<STUBS_DIR>\ISClient\ISClient.exe
<STUBS_DIR>\ekrn\ekrn.exe
<STUBS_DIR>\egni\egni.exe
<STUBS_DIR>\ecmd\ecmd.exe
<STUBS_DIR>\Drwebwcl\Drwebwcl.exe
<STUBS_DIR>\Drwebupw\Drwebupw.exe
<STUBS_DIR>\drweb386\drweb386.exe
<STUBS_DIR>\Drweb32w\Drweb32w.exe
<STUBS_DIR>\drweb\drweb.exe
<STUBS_DIR>\ClamWin\ClamWin.exe
<STUBS_DIR>\bdsubmit\bdsubmit.exe
<STUBS_DIR>\bdss\bdss.exe
<STUBS_DIR>\bdagent\bdagent.exe
<STUBS_DIR>\AVSYNMGR\AVSYNMGR.EXE
<STUBS_DIR>\AVPM\AVPM.EXE
<STUBS_DIR>\AVPCC\AVPCC.EXE
<STUBS_DIR>\AVP32\AVP32.EXE
<STUBS_DIR>\AVP\AVP.EXE
<STUBS_DIR>\AVGCTRL\AVGCTRL.EXE
<STUBS_DIR>\AVGCC32\AVGCC32.EXE
<STUBS_DIR>\avgcc\avgcc.exe
<STUBS_DIR>\ashAvSrv\ashAvSrv.exe
<STUBS_DIR>\ashAvast\ashAvast.exe
<STUBS_DIR>\ash\ash.exe
<STUBS_DIR>\aion\aion.exe
<STUBS_DIR>\ageofconan\ageofconan.exe
<STUBS_DIR>\fsav\fsav.exe
<STUBS_DIR>\fsav32\fsav32.exe
<STUBS_DIR>\fsavaui\fsavaui.exe
<STUBS_DIR>\fsavgui\fsavgui.exe
<STUBS_DIR>\intpro\intpro.exe
<STUBS_DIR>\inbank-start-ff\inbank-start-ff.exe
<STUBS_DIR>\elbank\elbank.exe
<STUBS_DIR>\contactNG\contactNG.exe
<STUBS_DIR>\clntw32\clntw32.exe
<STUBS_DIR>\clmain\clmain.exe
<STUBS_DIR>\client7\client7.exe
<STUBS_DIR>\clbank\clbank.exe
<STUBS_DIR>\cbsmain\cbsmain.exe
<STUBS_DIR>\cbmain\cbmain.exe
<STUBS_DIR>\cbank\cbank.exe
<STUBS_DIR>\bk\bk.exe
<STUBS_DIR>\bc_loader\bc_loader.exe
<STUBS_DIR>\bclient\bclient.exe
<STUBS_DIR>\BBClient\BBClient.exe
<STUBS_DIR>\bankcl\bankcl.exe
<STUBS_DIR>\ZONEALARM\ZONEALARM.EXE
<STUBS_DIR>\zapro\zapro.exe
<STUBS_DIR>\spidernt\spidernt.exe
<STUBS_DIR>\outpost\outpost.exe
<STUBS_DIR>\nod32\nod32.exe
<STUBS_DIR>\nod\nod.exe
<STUBS_DIR>\netxray\netxray.exe
<STUBS_DIR>\NAVAPW32\NAVAPW32.EXE
<STUBS_DIR>\mpftray\mpftray.exe
<STUBS_DIR>\GUARD\GUARD.EXE
<STUBS_DIR>\iscc\iscc.exe
<STUBS_DIR>\ZZ__cd75efb816b2cc__\ZZ__cd75efb816b2cc__.exe

Modifies file system:

Substitutes the following executable files:

<STUBS_DIR>\360tray\360tray.exe
<STUBS_DIR>\lotroclient\lotroclient.exe
<STUBS_DIR>\InphaseNXD\InphaseNXD.exe
<STUBS_DIR>\httplook\httplook.exe
<STUBS_DIR>\gw\gw.exe
<STUBS_DIR>\ge\ge.exe
<STUBS_DIR>\gc\gc.exe
<STUBS_DIR>\elementclient\elementclient.exe
<STUBS_DIR>\dnf\dnf.exe
<STUBS_DIR>\dekaron\dekaron.exe
<STUBS_DIR>\ccapp\ccapp.exe
<STUBS_DIR>\cabalmain\cabalmain.exe
<STUBS_DIR>\safari\safari.exe
<STUBS_DIR>\opera\opera.exe
<STUBS_DIR>\iexplore\iexplore.exe
<STUBS_DIR>\firefox\firefox.exe
<STUBS_DIR>\chrome\chrome.exe
<STUBS_DIR>\webmoney\webmoney.exe
<STUBS_DIR>\wclnt\wclnt.exe
<STUBS_DIR>\UniStream\UniStream.exe
<STUBS_DIR>\translink\translink.exe
<STUBS_DIR>\tiny\tiny.exe
<STUBS_DIR>\startclient7\startclient7.exe
<STUBS_DIR>\sgbclient\sgbclient.exe
<STUBS_DIR>\rclient\rclient.exe
<STUBS_DIR>\oncbcli\oncbcli.exe
<STUBS_DIR>\magent\magent.exe
<STUBS_DIR>\maplestory\maplestory.exe
<STUBS_DIR>\MCAGENT\MCAGENT.EXE
<STUBS_DIR>\Mir3Game\Mir3Game.exe
<STUBS_DIR>\putty\putty.exe
<STUBS_DIR>\ntvdm\ntvdm.exe
<STUBS_DIR>\javaw\javaw.exe
<STUBS_DIR>\java\java.exe
<STUBS_DIR>\YahooMessenger\YahooMessenger.exe
<STUBS_DIR>\wsm\wsm.exe
<STUBS_DIR>\trillian\trillian.exe
<STUBS_DIR>\skype\skype.exe
<STUBS_DIR>\qip\qip.exe
<STUBS_DIR>\pidgin\pidgin.exe
<STUBS_DIR>\msnmsgr\msnmsgr.exe
<STUBS_DIR>\msn6\msn6.exe
<STUBS_DIR>\ICQ\ICQ.exe
<STUBS_DIR>\miranda32\miranda32.exe
<STUBS_DIR>\googletalk\googletalk.exe
<STUBS_DIR>\zlclient\zlclient.exe
<STUBS_DIR>\ybclient\ybclient.exe
<STUBS_DIR>\wow\wow.exe
<STUBS_DIR>\woool\woool.exe
<STUBS_DIR>\winbaram\winbaram.exe
<STUBS_DIR>\TwelveSky2\TwelveSky2.exe
<STUBS_DIR>\sro_client\sro_client.exe
<STUBS_DIR>\so3d\so3d.exe
<STUBS_DIR>\smc\smc.exe
<STUBS_DIR>\RagFree\RagFree.exe
<STUBS_DIR>\Ragexe\Ragexe.exe
<STUBS_DIR>\__cd75efb816b2cc__\__cd75efb816b2cc__.exe
<STUBS_DIR>\loadmain\loadmain.exe
<STUBS_DIR>\kb_cli\kb_cli.exe
<STUBS_DIR>\ISClient\ISClient.exe
<STUBS_DIR>\ekrn\ekrn.exe
<STUBS_DIR>\egni\egni.exe
<STUBS_DIR>\ecmd\ecmd.exe
<STUBS_DIR>\Drwebwcl\Drwebwcl.exe
<STUBS_DIR>\Drwebupw\Drwebupw.exe
<STUBS_DIR>\drweb386\drweb386.exe
<STUBS_DIR>\Drweb32w\Drweb32w.exe
<STUBS_DIR>\drweb\drweb.exe
<STUBS_DIR>\ClamWin\ClamWin.exe
<STUBS_DIR>\bdsubmit\bdsubmit.exe
<STUBS_DIR>\bdss\bdss.exe
<STUBS_DIR>\bdagent\bdagent.exe
<STUBS_DIR>\AVSYNMGR\AVSYNMGR.EXE
<STUBS_DIR>\AVPM\AVPM.EXE
<STUBS_DIR>\AVPCC\AVPCC.EXE
<STUBS_DIR>\AVP32\AVP32.EXE
<STUBS_DIR>\AVP\AVP.EXE
<STUBS_DIR>\AVGCTRL\AVGCTRL.EXE
<STUBS_DIR>\AVGCC32\AVGCC32.EXE
<STUBS_DIR>\avgcc\avgcc.exe
<STUBS_DIR>\ashAvSrv\ashAvSrv.exe
<STUBS_DIR>\ashAvast\ashAvast.exe
<STUBS_DIR>\ash\ash.exe
<STUBS_DIR>\aion\aion.exe
<STUBS_DIR>\ageofconan\ageofconan.exe
<STUBS_DIR>\fsav\fsav.exe
<STUBS_DIR>\fsav32\fsav32.exe
<STUBS_DIR>\fsavaui\fsavaui.exe
<STUBS_DIR>\fsavgui\fsavgui.exe
<STUBS_DIR>\intpro\intpro.exe
<STUBS_DIR>\inbank-start-ff\inbank-start-ff.exe
<STUBS_DIR>\elbank\elbank.exe
<STUBS_DIR>\contactNG\contactNG.exe
<STUBS_DIR>\clntw32\clntw32.exe
<STUBS_DIR>\clmain\clmain.exe
<STUBS_DIR>\client7\client7.exe
<STUBS_DIR>\clbank\clbank.exe
<STUBS_DIR>\cbsmain\cbsmain.exe
<STUBS_DIR>\cbmain\cbmain.exe
<STUBS_DIR>\cbank\cbank.exe
<STUBS_DIR>\bk\bk.exe
<STUBS_DIR>\bc_loader\bc_loader.exe
<STUBS_DIR>\bclient\bclient.exe
<STUBS_DIR>\BBClient\BBClient.exe
<STUBS_DIR>\bankcl\bankcl.exe
<STUBS_DIR>\ZONEALARM\ZONEALARM.EXE
<STUBS_DIR>\zapro\zapro.exe
<STUBS_DIR>\spidernt\spidernt.exe
<STUBS_DIR>\outpost\outpost.exe
<STUBS_DIR>\nod32\nod32.exe
<STUBS_DIR>\nod\nod.exe
<STUBS_DIR>\netxray\netxray.exe
<STUBS_DIR>\NAVAPW32\NAVAPW32.EXE
<STUBS_DIR>\mpftray\mpftray.exe
<STUBS_DIR>\GUARD\GUARD.EXE
<STUBS_DIR>\iscc\iscc.exe
<STUBS_DIR>\ZZ__cd75efb816b2cc__\ZZ__cd75efb816b2cc__.exe

Network activity:

UDP:

DNS ASK qq####0226.3322.org
'qq####0226.3322.org':2018

Технології

Терміни

Навчання

Міфи

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней