BKDR_KELIHOS.NF
Backdoor:Win32/Kelihos.F (Microsoft); Win32/Kelihos.G (ESET-NOD32); Backdoor.Kelihos.F (CAT-QuickHeal)
Windows
Type de grayware:
Backdoor
Destructif:
Non
Chiffrement:
In the wild::
Oui
Overview
Détails techniques
Autostart-Technik
Fügt folgende Registrierungseinträge hinzu, um bei jedem Systemstart automatisch ausgeführt zu werden.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
{string 1}{string 2} = "{malware path}\{malware file}"
Andere Systemänderungen
Fügt die folgenden Registrierungseinträge hinzu:
HKEY_CURRENT_USER\Software\Microsoft\
IMEJP\{number}\MSIME\
AutoCharWidth
DefaultCompressedRecord = "{hex values}"
HKEY_CURRENT_USER\Software\Microsoft\
IMEJP\{number}\MSIME\
AutoCharWidth
RecordModifiedMax = "{random value}=="
HKEY_CURRENT_USER\Software\Microsoft\
IMEJP\{number}\MSIME\
AutoCharWidth
FlagsModifiedValid = "0"
HKEY_CURRENT_USER\Software\Sysinternals\
Process Explorer (Windows XP)
PersistentLocalizedName = "{hex values}"
HKEY_CURRENT_USER\Software\Sysinternals\
Process Explorer (Windows XP)
LineLoadedQuick = "{random value}=="
HKEY_CURRENT_USER\Software\Sysinternals\
Process Explorer (Windows XP)
PlatformCompressedValid = "0"
HKEY_CURRENT_USER\Software\TansuTCP (Windows XP)
ActiveModifiedTheme = "{hex values}"
HKEY_CURRENT_USER\Software\TansuTCP (Windows XP)
SizeCompletedValid = "{random value}=="
HKEY_CURRENT_USER\Software\TansuTCP (Windows XP)
InfoPlayedCurrent = "0"
HKEY_CURRENT_USER\Software\Sysinternals\
Process Explorer (Windows 7)
ActiveModifiedTheme = "{hex values}"
HKEY_CURRENT_USER\Software\Sysinternals\
Process Explorer (Windows 7)
SizeCompletedValid = "{random value}=="
HKEY_CURRENT_USER\Software\Sysinternals\
Process Explorer (Windows 7)
InfoPlayedCurrent = "0"
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\ime\
IMTC70 (Windows 7)
PersistentLocalizedName = "{hex values}"
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\ime\
IMTC70 (Windows 7)
LineLoadedQuick = "{random value}=="
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\ime\
IMTC70 (Windows 7)
PlatformCompressedValid = "0"
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\ime\
IMTC70 (Windows 7)
DBSavedUse = "{hex values}"
HKEY_CURRENT_USER\Software\Sysinternals\
Process Explorer (Windows XP)
DBSavedUse = "{hex values}"