TROJ_BAYROB.KSV
TrojanSpy:Win32/Nivdort!rfn (Microsoft), W32/Bayrob.X!tr (Fortinet), a variant of Win32/Bayrob.Y (ESET-NOD32)
Windows
Threat Type: Trojan
Destructiveness: No
Encrypted:
In the wild: Yes
OVERVIEW
This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.
It creates folders where it drops its files.
TECHNICAL DETAILS
1,873,408 bytes
EXE
Yes
18 Jun 2015
Arrival Details
This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.
Installation
This Trojan drops the following copies of itself into the affected system:
- %System%\dttakby.exe
- %System%\ofctseaz.exe
(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.)
It creates the following folders:
- %System%\ajmqgsznfqo
(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.)
Autostart Technique
This Trojan adds the following registry entries to enable its automatic execution at every system startup:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Enumerator Port Identity Security System = "%System%\dttakby.exe"
It registers as a system service to ensure its automatic execution at every system startup by adding the following registry keys:
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\Awareness Desktop Security WMI Transaction
ImagePath = "%System%\dttakby.exe"
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\Awareness Desktop Security WMI Transaction
DisplayName = "Awareness Desktop Security WMI Transaction"
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\Awareness Desktop Security WMI Transaction
Start = "2"
Other System Modifications
This Trojan adds the following registry keys:
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Enum\Root\LEGACY_AWARENESS_DESKTOP_SECURITY_WMI_TRANSACTION
It adds the following registry entries:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
FirewallDisableNotify = "1"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
FirewallOverride = "1"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
AntiVirusDisableNotify = "1"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
AntiVirusOverride = "1"
HOSTS File Modification
This Trojan overwrites the HOSTS file in the following locations:
- %System%\drivers\etc\host (On Windows 2000, XP, and Server 2003)
NOTES:
It connects to a set of random domains.