BKDR_REDFLOWER.ZBEE-A
Windows
Threat Type: Backdoor
Destructiveness: No
Encrypted: Yes
In the wild: Yes
OVERVIEW
Dropped by other malware
This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.
TECHNICAL DETAILS
103,424 bytes
EXE
Yes
26 Apr 2017
Connects to URLs/IPs
Arrival Details
This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.
Installation
This Backdoor adds the following processes:
- svchost.exe
It injects codes into the following process(es):
- svchost.exe
NOTES:
It searches for the file %System%\violent.dat and injects it on the created svchost.exe. As a result malicious routines of the injected file is exhibited into the system.
The loaded file attempts to connect to the following site to send and receive information:
- www.{BLOCKED}kipcare.com
It gathers the following:
- Hostname
- System version
- Memory
- System Platform/OS
- Address
- Grouds
- Priviledge
- CPU Information
It is capable of executing commands from a remote user:
- Create/Delete directories
- Copy/Delete/Rename/Move files
- Create/Terminate Processes
- Execute files/command
- Connect to remote sites
SOLUTION
9.850
13.378.02
03 May 2017
13.379.00
04 May 2017
Step 1
Before doing any scans, Windows XP, Windows Vista, and Windows 7 users must disable System Restore to allow full scanning of their computers.
Step 2
Restart in normal mode and scan your computer with your Trend Micro product for files detected as BKDR_REDFLOWER.ZBEE-A. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check this Knowledge Base page for more information.
Step 3
Search and delete these files
Did this description help? Tell us how we did.