NEUREVT
Windows 2000, Windows Server 2003, Windows XP (32-bit, 64-bit), Windows Vista (32-bit, 64-bit), Windows 7 (32-bit, 64-bit)
Tipo de malware
Backdoor
Destructivo?
No
Cifrado
In the Wild:
Sí
Resumen y descripción
Detalles técnicos
Instalación
Crea las siguientes copias de sí mismo en el sistema afectado:
- %Program Files%\Common Files\Flash Update Client.{2227A280-3AEA-1069-A2DE-08002B30309D}\{random file name}.exe
- %Program Files%\Common Files\Identities.{2227A280-3AEA-1069-A2DE-08002B30309D}\{random file name}.exe
(Nota: %Program Files% es la carpeta Archivos de programa predeterminada, que suele estar en C:\Archivos de programa).
)Otras modificaciones del sistema
Agrega las siguientes entradas de registro como parte de la rutina de instalación:
HKEY_CLASSES_ROOT\CLSID\{CLSID}
HKEY_CLASSES_ROOT\CLSID\{CLSID}\
0BAC02C7
HKEY_CURRENT_USER\Software\Microsoft\
Windows NT\CurrentVersion\TaskManager
HKEY_CLASSES_ROOT\CLSID\{CLSID}\
1BE003AB
HKEY_CLASSES_ROOT\CLSID\{CLSID}\
1BE003AB\CG1
HKEY_CLASSES_ROOT\CLSID\{CLSID}\
1BE003AB\CS1
HKEY_CLASSES_ROOT\CLSID\{CLSID}\
1BE003AB\CW1
HKEY_CURRENT_USER\Software\Win7zip
HKEY_LOCAL_MACHINE\SOFTWARE\Win7zip
Agrega las siguientes entradas de registro:
HKEY_CURRENT_USER\Software\Microsoft\
Windows NT\CurrentVersion\TaskManager
Task Service ID = "{hex value}"
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
Explorer\Run
Flash Update Client = "%Program Files%\Common Files\Flash Update Client.{2227A280-3AEA-1069-A2DE-08002B30309D}\{random file name}.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Flash Update Client = "%Program Files%\Common Files\Flash Update Client.{2227A280-3AEA-1069-A2DE-08002B30309D}\{random file name}.exe"
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Flash Update Client = "%Program Files%\Common Files\Flash Update Client.{2227A280-3AEA-1069-A2DE-08002B30309D}\{random file name}.exe"
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings\
Zones\1
2500 = "3"
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings\
Zones\2
2500 = "3"
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings\
Zones\3
2500 = "3"
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings\
Zones\4
2500 = "3"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
{application}
Debugger = "{random characters}.exe"
HKEY_CLASSES_ROOT\CLSID\{CLSID}\
1BE003AB\CG1
GLA = "{hex value}"
HKEY_CLASSES_ROOT\CLSID\{CLSID}\
1BE003AB\CG1
LCT = "{hex value}"
HKEY_CLASSES_ROOT\CLSID\{CLSID}\
1BE003AB\CG1
LSF = "{hex value}"
HKEY_CLASSES_ROOT\CLSID\{CLSID}\
1BE003AB\CG1
CF03 = "{hex value}"
HKEY_CLASSES_ROOT\CLSID\{CLSID}\
1BE003AB\CS1
SO3 = "{hex value}"
HKEY_CLASSES_ROOT\CLSID\{CLSID}\
1BE003AB\CW1
1480 = "{hex value}"
HKEY_CURRENT_USER\Software\Win7zip
Uuid = "{hex value}"
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Windows Device Installer = "{malware path and file name}"
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Windows Device Installer = "{malware path and file name}"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Windows Device Installer = "{malware path and file name}"
HKEY_LOCAL_MACHINE\SOFTWARE\Win7zip
Uuid = "{hex value}"
HKEY_CURRENT_USER\Software\Win7zip
Uuid = "{hex value}"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
nvtrays = "%Program Files%\Common Files\Identities.{2227A280-3AEA-1069-A2DE-08002B30309D}\{random file name}.exe"
Modifica las siguientes entradas de registro:
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
ShowSuperHidden = "0"
(Note: The default value data of the said registry entry is "1".)
HKEY_LOCAL_MACHINE\SOFTWARE\JavaSoft\
Java Update\Policy
EnableJavaUpdate = "0"
(Note: The default value data of the said registry entry is "1".)