BKDR_ZACCESS.GB

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This backdoor drops the following non-malicious file:

• %Windows%\1493438348

(Note: %Windows% is the Windows folder, which is usually C:\Windows or C:\WINNT.)

Autostart Technique

This backdoor registers itself as a system service to ensure its automatic execution at every system startup by adding the following registry entries:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\8c0f0459
Type = "1"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\8c0f0459
Start = "3"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\8c0f0459
ImagePath = "\systemroot\1493438348:1945172902.exe"

Other System Modifications

This backdoor adds the following registry keys:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\8c0f0459

Other Details

This backdoor connects to the following possibly malicious URL:

• http://sstatic1.histats.com/0.gif?1631605&101

NOTES:

It installs itself as an Alternate Data Stream (ADS) in its dropped file, %Windows%\1493438348. The ADS has the following name:

• %System%\1493438348:1945172902.exe