BKDR_ANDROM.IP
Backdoor.Win32.Androm.adwr (Kaspersky)
Windows 2000, Windows Server 2003, Windows XP (32-bit, 64-bit), Windows Vista (32-bit, 64-bit), Windows 7 (32-bit, 64-bit)
![](/vinfo/imgFiles/legend.jpg)
Threat Type: Backdoor
Destructiveness: No
Encrypted:
In the wild: Yes
OVERVIEW
This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.
It modifies the Internet Explorer Zone Settings.
It deletes itself after execution.
TECHNICAL DETAILS
39,227,392 bytes
EXE
No
18 Jul 2013
Arrival Details
This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.
Other System Modifications
This backdoor adds the following registry entries:
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSConfig = "%User Profile%\{Random File Name}.exe"
Web Browser Home Page and Search Page Modification
This backdoor modifies the Internet Explorer Zone Settings.
Other Details
This backdoor drops the following file(s)/component(s):
- %User Profile%\{Random File Name}.exe
(Note: %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003, or C:\Users\{user name} on Windows Vista and 7.)
It deletes itself after execution.