BackDoor.IRC.Sdbot.18291

Technical Information

To ensure autorun and distribution

Creates or modifies the following files

%ALLUSERSPROFILE%\start menu\programs\startup\msmsgs.exe
%ALLUSERSPROFILE%\start menu\programs\startup\rcx6.tmp

Creates the following services

[<HKLM>\SYSTEM\ControlSet001\Services\srservice] 'Start' = '00000002'
[<HKLM>\SYSTEM\ControlSet001\Services\srservice] 'ImagePath' = '%WINDIR%\svchost.eXe'

Creates the following files on removable media

<Drive name for removable media>:\~angle.exe
<Drive name for removable media>:\4f0bf7ff71f28.exe
<Drive name for removable media>:\13.exe
<Drive name for removable media>:\168.exe
<Drive name for removable media>:\1189.exe
<Drive name for removable media>:\region-north-karelia.exe
<Drive name for removable media>:\block.exe
<Drive name for removable media>:\calibre.exe
<Drive name for removable media>:\background.exe
<Drive name for removable media>:\asm.exe
<Drive name for removable media>:\arrow-down.exe
<Drive name for removable media>:\excel_example.exe
<Drive name for removable media>:\price030215.exe
<Drive name for removable media>:\productos.exe
<Drive name for removable media>:\1sm_price.exe
<Drive name for removable media>:\price.exe
<Drive name for removable media>:\contractualdeadlines.exe
<Drive name for removable media>:\calculatorworksheet.exe
<Drive name for removable media>:\pushkin.exe
<Drive name for removable media>:\~'.exe
<Drive name for removable media>:\2.exe
<Drive name for removable media>:\adadsi.exe
<Drive name for removable media>:\~.exe
<Drive name for removable media>:\coffee.exe
<Drive name for removable media>:\dashborder_144.exe
<Drive name for removable media>:\default.exe
<Drive name for removable media>:\toolbar.exe
<Drive name for removable media>:\skypesetup'.exe
<Drive name for removable media>:\rcx12.tmp
<Drive name for removable media>:\calc'.exe
<Drive name for removable media>:\rcx13.tmp
<Drive name for removable media>:\utorrent'.exe
<Drive name for removable media>:\rcx14.tmp
<Drive name for removable media>:\64bit_notes.exe
<Drive name for removable media>:\ituneshelpunavailable.exe
<Drive name for removable media>:\alert.exe
<Drive name for removable media>:\browse.exe
<Drive name for removable media>:\tree_view.exe
<Drive name for removable media>:\about.exe
<Drive name for removable media>:\howto-index.exe
<Drive name for removable media>:\rcx15.tmp

Malicious functions

To complicate detection of its presence in the operating system,

forces the system hide from view:

hidden files
file extensions

modifies the following system settings:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoSetFolders' = '00000001'

Modifies file system

Creates the following files

%ALLUSERSPROFILE%\documents\my pictures\svchost.exe
%ALLUSERSPROFILE%\documents\my music\rcxf.tmp
%WINDIR%\rcxe.tmp
%ALLUSERSPROFILE%\documents\my music\rcxd.tmp
C:\surat buat presiden.htm
%ALLUSERSPROFILE%\documents\my music\rcxc.tmp
%ALLUSERSPROFILE%\documents\my pictures\rcxb.tmp
%ALLUSERSPROFILE%\documents\my pictures\jpg.exe
%ALLUSERSPROFILE%\documents\my pictures\rcxa.tmp
%ALLUSERSPROFILE%\documents\my pictures\iexplore.exe
%ALLUSERSPROFILE%\documents\my pictures\rcx9.tmp
%ALLUSERSPROFILE%\documents\my pictures\wmplayer.exe
%ALLUSERSPROFILE%\documents\my music\angle.zip
%ALLUSERSPROFILE%\documents\my music\rcx10.tmp
%ALLUSERSPROFILE%\documents\my pictures\rcx8.tmp
%WINDIR%\rcx7.tmp
%WINDIR%\regedit.reg
%WINDIR%\ziprar.exe
%ALLUSERSPROFILE%\documents\my music\rcx5.tmp
%ALLUSERSPROFILE%\documents\my music\angle.exe
<SYSTEM32>\rcx4.tmp
<SYSTEM32>\angle.exe
%WINDIR%\rcx3.tmp
%WINDIR%\svchost.exe
%ALLUSERSPROFILE%\documents\my music\rcx2.tmp
%ALLUSERSPROFILE%\documents\my music\svchost.exe
%ALLUSERSPROFILE%\documents\my pictures\rcx1.tmp
%ALLUSERSPROFILE%\documents\my pictures\messenger.exe
%ALLUSERSPROFILE%\documents\my music\rcx11.tmp

Sets the 'hidden' attribute to the following files

%ALLUSERSPROFILE%\documents\my pictures\svchost.exe
%ALLUSERSPROFILE%\documents\my music\svchost.exe
%WINDIR%\svchost.exe
<SYSTEM32>\angle.exe
<Drive name for removable media>:\~.exe
<Drive name for removable media>:\~angle.exe

Deletes the following files

%ALLUSERSPROFILE%\documents\my pictures\svchost.exe
%ALLUSERSPROFILE%\documents\my music\svchost.exe
%WINDIR%\svchost.exe
<SYSTEM32>\angle.exe
%ALLUSERSPROFILE%\documents\my music\angle.exe
%ALLUSERSPROFILE%\start menu\programs\startup\msmsgs.exe
%WINDIR%\ziprar.exe
%ALLUSERSPROFILE%\documents\my pictures\messenger.exe
%ALLUSERSPROFILE%\documents\my pictures\wmplayer.exe
%ALLUSERSPROFILE%\documents\my pictures\iexplore.exe
%ALLUSERSPROFILE%\documents\my pictures\jpg.exe
<Drive name for removable media>:\skypesetup'.exe
<Drive name for removable media>:\calc'.exe
<Drive name for removable media>:\utorrent'.exe
<Drive name for removable media>:\~'.exe

Substitutes the following files

%ALLUSERSPROFILE%\documents\my pictures\svchost.exe
%ALLUSERSPROFILE%\documents\my music\svchost.exe
%WINDIR%\svchost.exe
<SYSTEM32>\angle.exe
%ALLUSERSPROFILE%\documents\my music\angle.exe
%WINDIR%\ziprar.exe
%ALLUSERSPROFILE%\documents\my pictures\messenger.exe
%ALLUSERSPROFILE%\documents\my pictures\wmplayer.exe
%ALLUSERSPROFILE%\documents\my pictures\iexplore.exe
%ALLUSERSPROFILE%\documents\my pictures\jpg.exe
<Drive name for removable media>:\skypesetup'.exe
<Drive name for removable media>:\calc'.exe
<Drive name for removable media>:\utorrent'.exe
<Drive name for removable media>:\~'.exe

Miscellaneous

Creates and executes the following

'%ALLUSERSPROFILE%\documents\my pictures\svchost.exe'
'%ALLUSERSPROFILE%\start menu\programs\startup\msmsgs.exe'
'<SYSTEM32>\angle.exe'
'%ALLUSERSPROFILE%\documents\my pictures\wmplayer.exe'
'<SYSTEM32>\reg.exe' export HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\srservice %WINDIR%\regedit.reg' (with hidden window)
'%ProgramFiles%\winrar\rar.exe' a -ao -ep "%ALLUSERSPROFILE%\Documents\My Music\angle.Zip" "%ALLUSERSPROFILE%\Documents\My Music\angle.eXe"' (with hidden window)

Executes the following

'<SYSTEM32>\reg.exe' export HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\srservice %WINDIR%\regedit.reg
'%ProgramFiles%\winrar\rar.exe' a -ao -ep "%ALLUSERSPROFILE%\Documents\My Music\angle.Zip" "%ALLUSERSPROFILE%\Documents\My Music\angle.eXe"

Демо бесплатно на 14 дней

Выдаётся при установке

Скачать с сайта

Скачать с Google Play

Завантажте
Dr.Web для Android

Безкоштовно на 3 місяці
Всі компоненти захисту
Подовження демо в
AppGallery/Google Pay

Технології

Терміни

Навчання

Міфи

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней