arrow_back
search
close

BKDR_KELIHOS.SMF

April 24, 2015
 ALIASES:

Backdoor:Win32/Kelihos.F(Microsoft), Trojan-PWS.Win32.Fareit(Ikarus)

 PLATFORM:

Windows

 OVERALL RISK RATING:
 DAMAGE POTENTIAL:
 DISTRIBUTION POTENTIAL:
 REPORTED INFECTION:
 INFORMATION EXPOSURE:

  • Threat Type: Backdoor

  • Destructiveness: No

  • Encrypted:

  • In the wild: Yes

  OVERVIEW

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

  TECHNICAL DETAILS

File Size:

833,536 bytes

File Type:

EXE

Memory Resident:

Yes

Initial Samples Received Date:

10 May 2013

Arrival Details

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Autostart Technique

This backdoor adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
{random parameter 1}{random parameter 2} = "{malware path and file name}"

Other Details

This backdoor connects to the following possibly malicious URL:

  • {BLOCKED}.{BLOCKED}.64.114
  • {BLOCKED}.{BLOCKED}.38.78
  • {BLOCKED}.{BLOCKED}.66.204
  • {BLOCKED}.{BLOCKED}.12.8
  • {BLOCKED}.{BLOCKED}.96.3
  • {BLOCKED}.{BLOCKED}.152.208
  • {BLOCKED}.{BLOCKED}.135.33
  • {BLOCKED}.{BLOCKED}.104.200
  • {BLOCKED}.{BLOCKED}.149.249
  • {BLOCKED}.{BLOCKED}.41.34
  • {BLOCKED}.{BLOCKED}.100.68
  • {BLOCKED}.{BLOCKED}.12.199
  • {BLOCKED}.{BLOCKED}.21.32
  • {BLOCKED}.{BLOCKED}.9.226
  • {BLOCKED}.{BLOCKED}.18.101

NOTES:

This backdoor modifies its file attributes to read-only and hidden after execution.

The auto-run registry, {random parameter 1} can be any of the following:

  • Network
  • Time
  • CrashReport
  • Database
  • Icon
  • Desktop
  • Tray
  • Video
  • Media

The auto-run registry, {random parameter 2} can be any of the following:

  • Checker
  • Informer
  • Notifyer
  • Saver
  • Updater
  • Verifyer

For example:

  • NetworkVerifyer
  • TrayNotifyer
  • CrashReportUpdater