BKDR_KELIHOS.ND
Backdoor:Win32/Kelihos (Microsoft); Trojan.Win32.Kelihos (A) (Emsisoft); W32/Tepfer.PDNJ!tr.pws (Fortinet)
Windows
Malware-Typ:
Backdoor
Zerstrerisch?:
Nein
Verschlsselt?:
In the wild::
Ja
Überblick
Technische Details
Autostart-Technik
Fügt folgende Registrierungseinträge hinzu, um bei jedem Systemstart automatisch ausgeführt zu werden.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
{string 1}{string 2} = "{malware path}\{malware file}"
Andere Systemänderungen
Fügt die folgenden Registrierungseinträge hinzu:
HKEY_CURRENT_USER\Software\Microsoft\
IMEJP\{number}\MSIME\
AutoCharWidth
DefaultCompressedRecord = "{hex values}"
HKEY_CURRENT_USER\Software\Microsoft\
IMEJP\{number}\MSIME\
AutoCharWidth
RecordModifiedMax = "{random value}=="
HKEY_CURRENT_USER\Software\Microsoft\
IMEJP\{number}\MSIME\
AutoCharWidth
FlagsModifiedValid = "0"
HKEY_CURRENT_USER\Software\Sysinternals\
Process Explorer (Windows XP)
PersistentLocalizedName = "{hex values}"
HKEY_CURRENT_USER\Software\Sysinternals\
Process Explorer (Windows XP)
LineLoadedQuick = "{random value}=="
HKEY_CURRENT_USER\Software\Sysinternals\
Process Explorer (Windows XP)
PlatformCompressedValid = "0"
HKEY_CURRENT_USER\Software\TansuTCP (Windows XP)
ActiveModifiedTheme = "{hex values}"
HKEY_CURRENT_USER\Software\TansuTCP (Windows XP)
SizeCompletedValid = "{random value}=="
HKEY_CURRENT_USER\Software\TansuTCP (Windows XP)
InfoPlayedCurrent = "0"
HKEY_CURRENT_USER\Software\Sysinternals\
Process Explorer (Windows 7)
ActiveModifiedTheme = "{hex values}"
HKEY_CURRENT_USER\Software\Sysinternals\
Process Explorer (Windows 7)
SizeCompletedValid = "{random value}=="
HKEY_CURRENT_USER\Software\Sysinternals\
Process Explorer (Windows 7)
InfoPlayedCurrent = "0"
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\ime\
IMTC70 (Windows 7)
PersistentLocalizedName = "{hex values}"
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\ime\
IMTC70 (Windows 7)
LineLoadedQuick = "{random value}=="
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\ime\
IMTC70 (Windows 7)
PlatformCompressedValue = "0"
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\ime\
IMTC70 (Windows 7)
DBSavedUser = "{hex values}"