Backdoor.Win32.BADIIS.A

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Übertragungsdetails

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Andere Details

Es macht Folgendes:

• It modifies responses to HTTP requests from selected search engine web crawlers to serve a malicious JavaScript file, potentially redirect code that would force the search engine to follow the redirect and index the content of the attacker’s choice
  • It requires the following parameters of the handled requests:
  • Content-Type header is set to text/html
  • The relative URL of the request contains one of the following substrings:
  • index.php
  • User-Agent header contains one of the following substrings:
  • baidu
  • sogou
  • yisou
  • baidu.com
  • sogou.com
  • so.com
  • sm.cn
• It replaces responses to HTTP requests from web crawlers with attacker-controlled content.
  • Search engine crawler requests are recognized when the following two conditions matched:
  • The request URL contains one of these substrings:
    • .php
    • .asp
    • .aspx
    • .jsp
    • .html
    • .htm
  • The User-Agent header contains one of these substrings:
  • baidu.com
  • sogou.com
  • so.com
  • sm.cn
  • bing.com
  • google
  • coccoc
• It replaces responses to HTTP requests from selected visitors with malicious/unwanted content.