BKDR_KELIHOS.NE
Backdoor:Win32/Kelihos.F (Microsoft); Backdoor.Win32.Kelihos.c (v) (VIPRE); BDS/Kelihos.F.4220 (Avira)
Windows
Tipo di minaccia informatica:
Backdoor
Distruttivo?:
No
Crittografato?:
In the wild::
Sì
Panoramica e descrizione
Dettagli tecnici
Técnica de inicio automático
Agrega las siguientes entradas de registro para permitir su ejecución automática cada vez que se inicia el sistema:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
{string 1}{string 2} = "{malware path}\{malware file}"
Otras modificaciones del sistema
Agrega las siguientes entradas de registro:
HKEY_CURRENT_USER\Software\Microsoft\
IMEJP\{number}\MSIME\
AutoCharWidth
DefaultCompressedRecord = "{hex values}"
HKEY_CURRENT_USER\Software\Microsoft\
IMEJP\{number}\MSIME\
AutoCharWidth
RecordModifiedMax = "{random value}=="
HKEY_CURRENT_USER\Software\Microsoft\
IMEJP\{number}\MSIME\
AutoCharWidth
FlagsModifiedValid = "0"
HKEY_CURRENT_USER\Software\Sysinternals\
Process Explorer (Windows XP)
PersistentLocalizedName = "{hex values}"
HKEY_CURRENT_USER\Software\Sysinternals\
Process Explorer (Windows XP)
LineLoadedQuick = "{random value}=="
HKEY_CURRENT_USER\Software\Sysinternals\
Process Explorer (Windows XP)
PlatformCompressedValid = "0"
HKEY_CURRENT_USER\Software\TansuTCP (Windows XP)
ActiveModifiedTheme = "{hex values}"
HKEY_CURRENT_USER\Software\TansuTCP (Windows XP)
SizeCompletedValid = "{random value}=="
HKEY_CURRENT_USER\Software\TansuTCP (Windows XP)
InfoPlayedCurrent = "0"
HKEY_CURRENT_USER\Software\Sysinternals\
Process Explorer (Windows 7)
ActiveModifiedTheme = "{hex values}"
HKEY_CURRENT_USER\Software\Sysinternals\
Process Explorer (Windows 7)
SizeCompletedValid = "{random value}=="
HKEY_CURRENT_USER\Software\Sysinternals\
Process Explorer (Windows 7)
InfoPlayedCurrent = "0"
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\ime\
IMTC70 (Windows 7)
PersistentLocalizedName = "{hex values}"
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\ime\
IMTC70 (Windows 7)
LineLoadedQuick = "{random value}=="
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\ime\
IMTC70 (Windows 7)
PlatformCompressedValid = "0"
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\ime\
IMTC70 (Windows 7)
DBSavedUse = "{hex values}"