BKDR_KELIHOS.ND
Backdoor:Win32/Kelihos (Microsoft); Trojan.Win32.Kelihos (A) (Emsisoft); W32/Tepfer.PDNJ!tr.pws (Fortinet)
Windows
Tipo di minaccia informatica:
Backdoor
Distruttivo?:
No
Crittografato?:
In the wild::
Sì
Panoramica e descrizione
Dettagli tecnici
Técnica de inicio automático
Agrega las siguientes entradas de registro para permitir su ejecución automática cada vez que se inicia el sistema:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
{string 1}{string 2} = "{malware path}\{malware file}"
Otras modificaciones del sistema
Agrega las siguientes entradas de registro:
HKEY_CURRENT_USER\Software\Microsoft\
IMEJP\{number}\MSIME\
AutoCharWidth
DefaultCompressedRecord = "{hex values}"
HKEY_CURRENT_USER\Software\Microsoft\
IMEJP\{number}\MSIME\
AutoCharWidth
RecordModifiedMax = "{random value}=="
HKEY_CURRENT_USER\Software\Microsoft\
IMEJP\{number}\MSIME\
AutoCharWidth
FlagsModifiedValid = "0"
HKEY_CURRENT_USER\Software\Sysinternals\
Process Explorer (Windows XP)
PersistentLocalizedName = "{hex values}"
HKEY_CURRENT_USER\Software\Sysinternals\
Process Explorer (Windows XP)
LineLoadedQuick = "{random value}=="
HKEY_CURRENT_USER\Software\Sysinternals\
Process Explorer (Windows XP)
PlatformCompressedValid = "0"
HKEY_CURRENT_USER\Software\TansuTCP (Windows XP)
ActiveModifiedTheme = "{hex values}"
HKEY_CURRENT_USER\Software\TansuTCP (Windows XP)
SizeCompletedValid = "{random value}=="
HKEY_CURRENT_USER\Software\TansuTCP (Windows XP)
InfoPlayedCurrent = "0"
HKEY_CURRENT_USER\Software\Sysinternals\
Process Explorer (Windows 7)
ActiveModifiedTheme = "{hex values}"
HKEY_CURRENT_USER\Software\Sysinternals\
Process Explorer (Windows 7)
SizeCompletedValid = "{random value}=="
HKEY_CURRENT_USER\Software\Sysinternals\
Process Explorer (Windows 7)
InfoPlayedCurrent = "0"
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\ime\
IMTC70 (Windows 7)
PersistentLocalizedName = "{hex values}"
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\ime\
IMTC70 (Windows 7)
LineLoadedQuick = "{random value}=="
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\ime\
IMTC70 (Windows 7)
PlatformCompressedValue = "0"
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\ime\
IMTC70 (Windows 7)
DBSavedUser = "{hex values}"