BackDoor.Poison.13230

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Active Setup\Installed Components\{9D71D88C-C598-4935-C5D1-43AA4DB90836}] 'stubpath' = ''

Вредоносные функции:

Создает и запускает на исполнение:

'C:\Extracted\No Bypass.exe'
'C:\Extracted\Server Aggressive Mode.exe'

Запускает на исполнение:

'<SYSTEM32>\wbem\wmiadap.exe' /R /T

Внедряет код в

следующие системные процессы:

%WINDIR%\Explorer.EXE

Ищет следующие окна с целью

обнаружения утилит для анализа:

ClassName: '' WindowName: 'PEiD v0.95'

Изменения в файловой системе:

Создает следующие файлы:

C:\Extracted\Server Aggressive Mode.exe
%PROGRAM_FILES%\Bifrost\server.exe
%TEMP%\sfx.ini
C:\Extracted\No Bypass.exe

Удаляет следующие файлы:

%PROGRAM_FILES%\Bifrost\server.exe
%TEMP%\sfx.ini

Сетевая активность:

Подключается к:

'localhost':81

Другое:

Ищет следующие окна:

ClassName: '' WindowName: 'Warning from Tiny Watcher'
ClassName: '' WindowName: 'Setup Capture - Welcome'
ClassName: '' WindowName: 'Setup Capture - Prescan'
ClassName: '' WindowName: 'DE Decompiler Lite v2.0'
ClassName: '' WindowName: 'Exeinfo PE - ver.0.0.3.0 by A.S.L - 617 sign 2011.07.29'
ClassName: '' WindowName: 'Colasoft Capsa 7 Free'
ClassName: '' WindowName: 'Speed Gear v7.2'
ClassName: '' WindowName: 'TCPEye'
ClassName: '' WindowName: 'Toolwiz Care'
ClassName: '' WindowName: 'MaaTec Network Analyzer'
ClassName: '' WindowName: 'Piriform CCleaner'
ClassName: '' WindowName: 'KaKeeware Application Monitor 1.32'
ClassName: '' WindowName: 'Open Ports Scanner'
ClassName: '' WindowName: 'DeDe 3.50.04 (c) 1999-2003 by DaFixer/TMG'
ClassName: '' WindowName: 'Shadow Defender'
ClassName: '' WindowName: '<SYSTEM32>\cmd.exe'
ClassName: '' WindowName: 'Add or Remove Programs'
ClassName: '' WindowName: 'TeamViewer'
ClassName: '' WindowName: 'Windows Security Center'
ClassName: '' WindowName: 'Windows Firewall'
ClassName: '' WindowName: 'Run'
ClassName: '' WindowName: 'Universal Extractor v1.6.1'
ClassName: '' WindowName: 'UPXGUI for UPX 305w ~ daYOda @ krakenstein.cz.cc ~ Juni 2010'
ClassName: '' WindowName: 'RL!dePacker - Generic Unpacker'
ClassName: '' WindowName: 'Registry Editor'
ClassName: '' WindowName: 'System Configuration Utility'
ClassName: '' WindowName: 'Windows Task Manager'
ClassName: '' WindowName: 'SpyStudio'
ClassName: '' WindowName: 'Scan Registry'
ClassName: '' WindowName: 'Compare Dump Files'
ClassName: '' WindowName: 'Process Analyzer - right click on a process to access menu'
ClassName: '' WindowName: 'SysAnalyzer Configuration Wizard'
ClassName: '' WindowName: 'Blade API Monitor 3.7.5.6'
ClassName: '' WindowName: 'Кг ЕдФЗБ гЭКЗН МПнП'
ClassName: '' WindowName: '[ LordPE Deluxe b ] by yoda'
ClassName: '' WindowName: 'Spy-The-Spy Warning!'
ClassName: '' WindowName: 'OllyDbg'
ClassName: '' WindowName: '?? ????? ????? ????'
ClassName: '' WindowName: 'ApateDNS'
ClassName: '' WindowName: 'SacaCorchos V1.0'
ClassName: '' WindowName: 'sniff_hit'
ClassName: '' WindowName: 'PowerTool V3.8'
ClassName: '' WindowName: 'Regshot 1.8.1'
ClassName: '' WindowName: 'TCPView'
ClassName: '' WindowName: 'The Wireshark Network Analyzer [Wireshark 1.8.3 (SVN Rev 45256 from /trunk-1.8)]'
ClassName: '' WindowName: 'SmartSniff'
ClassName: '' WindowName: 'eeThink IP Blocker 2.0 - Blocker is enabled'
ClassName: '' WindowName: 'NetworkMiner 1.4.1'
ClassName: '' WindowName: 'DeepMonitor - Hidden processes detector'
ClassName: '' WindowName: 'CurrPorts'
ClassName: '' WindowName: 'APIMonitor (Registered Version)'
ClassName: '' WindowName: 'NetStat Agent 3.5'
ClassName: '' WindowName: 'NetStat Agent 2.1.3'
ClassName: '' WindowName: 'MKN TaskExplorer 5'