BKDR_VAWTRAK.YVH
Trojan-PSW.Win32.Tepfer.tttf (Kaspersky), Backdoor:Win32/Vawtrak.D (Microsoft), Win32/PSW.Papras.DC trojan (ESET)
Windows 2000, Windows Server 2003, Windows XP (32-bit, 64-bit), Windows Vista (32-bit, 64-bit), Windows 7 (32-bit, 64-bit)
Threat Type: Backdoor
Destructiveness: No
Encrypted:
In the wild: Yes
OVERVIEW
This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.
TECHNICAL DETAILS
227,784 bytes
DLL
24 Apr 2014
Arrival Details
This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.
Autostart Technique
This backdoor adds the following registry entries to enable its automatic execution at every system startup:
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
{malware name} = "regsvr32.exe "{malware path}\{malware name}.{file extension}""
Other System Modifications
This backdoor adds the following registry entries:
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows\Safer\
CodeIdentifiers
PolicyScope = "0"
HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Main
NoProtectedModeBanner = "1"
HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Main
TabProcGrowth = "0"
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings\
Zones\3
2500 = "3"
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows\Safer\
CodeIdentifiers
DefaultLevel = "262144"
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows\Safer\
CodeIdentifiers
TransparentEnabled = "1"
Other Details
This backdoor connects to the following possibly malicious URL:
- http://{BLOCKED}onally.com/forumdisplay.php?fid={value}
- http://{BLOCKED}ilix.com/forumdisplay.php?fid={value}
- http://{BLOCKED}ag.com/forumdisplay.php?fid={value}
- http://{BLOCKED}old.com/forumdisplay.php?fid={value}
- http://{BLOCKED}oxon.com/forumdisplay.php?fid={value}
- http://{BLOCKED}5.{BLOCKED}.32.67/forumdisplay.php?fid={value}
- http://{BLOCKED}5.{BLOCKED}.32.80/forumdisplay.php?fid={value}
- http://{BLOCKED}6.{BLOCKED}5.233.38/forumdisplay.php?fid={value}
- http://{BLOCKED}olon.com/{BLOCKED}mdisplay.php?fid={value}
- http://{BLOCKED}6.{BLOCKED}5.233.80/forumdisplay.php?fid={value}
- http://{BLOCKED}diaz.com/{BLOCKED}display.php?fid={value}
- http://{BLOCKED}ilpane.com/{BLOCKED}display.php?fid={value}