Backdoor.Win32.DASERF.A
Backdoor:Win32/Daserf.A (MICROSOFT); Trojan.Win32.Generic.pak!cobra (SUNBELT)
Windows
Threat Type:
Backdoor
Destructiveness:
No
Encrypted:
In the wild::
Yes
OVERVIEW
It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.
TECHNICAL DETAILS
Detalles de entrada
It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.
Rutina de infiltración
Infiltra los archivos siguientes:
- %User Temp%\KB2791997.log
- %User Temp%\perfc091.dat
- %User Temp%\perfh091.dat
(Nota: %User Temp% es la carpeta Temp del usuario activo, que en el caso de Windows 2000(32-bit), XP y Server 2003(32-bit) suele estar en C:\Documents and Settings\{nombre de usuario}\Local Settings\Temp y en el case de Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) y 10(64-bit) en C:\Users\{nombre de usuario}\AppData\Local\Temp).
)Otros detalles
It connects to the following possibly malicious URL:
- http://key.{BLOCKED}upper.info