BKDR_POISON.NT
PLATFORM:
Windows 2000, Windows XP, Windows Server 2003
OVERALL RISK RATING:
DAMAGE POTENTIAL:
DISTRIBUTION POTENTIAL:
REPORTED INFECTION:
Threat Type: Backdoor
Destructiveness: No
Encrypted:
In the wild: Yes
OVERVIEW
This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.
It deletes itself after execution.
TECHNICAL DETAILS
File Size:
330,752 bytes
File Type:
EXE
Memory Resident:
Yes
Initial Samples Received Date:
15 Feb 2009
Arrival Details
This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.
Installation
This backdoor drops the following copies of itself into the affected system and executes them:
- %System Root%\RECYCLER\doc.xls
(Note: %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.)
It drops the following component file(s):
- %System Root%\RECYCLER\Game.swf
- %System Root%\{2 random characters}exe.com).xls
Other Details
This backdoor deletes itself after execution.