arrow_back
search
close

TROJ_BAYROB.KSV

June 22, 2015
 ALIASES:

TrojanSpy:Win32/Nivdort!rfn (Microsoft), W32/Bayrob.X!tr (Fortinet), a variant of Win32/Bayrob.Y (ESET-NOD32)

 PLATFORM:

Windows

 OVERALL RISK RATING:
 DAMAGE POTENTIAL:
 DISTRIBUTION POTENTIAL:
 REPORTED INFECTION:
 INFORMATION EXPOSURE:

  • Threat Type: Trojan

  • Destructiveness: No

  • Encrypted:

  • In the wild: Yes

  OVERVIEW

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It creates folders where it drops its files.

  TECHNICAL DETAILS

File Size:

1,873,408 bytes

File Type:

EXE

Memory Resident:

Yes

Initial Samples Received Date:

18 Jun 2015

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan drops the following copies of itself into the affected system:

  • %System%\dttakby.exe
  • %System%\ofctseaz.exe

(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.)

It creates the following folders:

  • %System%\ajmqgsznfqo

(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.)

Autostart Technique

This Trojan adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Enumerator Port Identity Security System = "%System%\dttakby.exe"

It registers as a system service to ensure its automatic execution at every system startup by adding the following registry keys:

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\Awareness Desktop Security WMI Transaction
ImagePath = "%System%\dttakby.exe"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\Awareness Desktop Security WMI Transaction
DisplayName = "Awareness Desktop Security WMI Transaction"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\Awareness Desktop Security WMI Transaction
Start = "2"

Other System Modifications

This Trojan adds the following registry keys:

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Enum\Root\LEGACY_AWARENESS_DESKTOP_SECURITY_WMI_TRANSACTION

It adds the following registry entries:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
FirewallDisableNotify = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
FirewallOverride = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
AntiVirusDisableNotify = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
AntiVirusOverride = "1"

HOSTS File Modification

This Trojan overwrites the HOSTS file in the following locations:

  • %System%\drivers\etc\host (On Windows 2000, XP, and Server 2003)

NOTES:

It connects to a set of random domains.