BKDR_THOPER.AS
April 11, 2013
ALIASES:
Backdoor:Win32/Thoper.E(Microsoft), Win32/Korplug.J trojan((Eset)
PLATFORM:
Windows 2000, Windows Server 2003, Windows XP (32-bit, 64-bit), Windows Vista (32-bit, 64-bit), Windows 7 (32-bit, 64-bit)
OVERALL RISK RATING:
DAMAGE POTENTIAL:
DISTRIBUTION POTENTIAL:
REPORTED INFECTION:
Threat Type: Backdoor
Destructiveness: No
Encrypted:
In the wild: Yes
OVERVIEW
This backdoor arrives as a component bundled with malware/grayware packages.
TECHNICAL DETAILS
File Size: 225,280 bytes
File Type: DLL
Memory Resident: Yes
Initial Samples Received Date: 10 Apr 2013
Arrival Details
This backdoor arrives as a component bundled with malware/grayware packages.
Other System Modifications
This backdoor adds the following registry keys:
HKEY_CLASSES_ROOT\SS
It adds the following registry entries:
HKEY_CLASSES_ROOT\SS
CLSID = "{random value}"
Other Details
This backdoor connects to the following possibly malicious URL:
- http://{BLOCKED}t.{BLOCKED}k-sec.net