TROJ_BAYROB.KSV
TrojanSpy:Win32/Nivdort!rfn (Microsoft), W32/Bayrob.X!tr (Fortinet), a variant of Win32/Bayrob.Y (ESET-NOD32)
Windows
Threat Type: Trojan
Destructiveness: No
Encrypted:
In the wild: Yes
OVERVIEW
This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.
It creates folders where it drops its files.
TECHNICAL DETAILS
Arrival Details
This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.
Installation
This Trojan drops the following copies of itself into the affected system:
- %System%\dttakby.exe
- %System%\ofctseaz.exe
(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.)
It creates the following folders:
- %System%\ajmqgsznfqo
(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.)
Autostart Technique
This Trojan adds the following registry entries to enable its automatic execution at every system startup:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Enumerator Port Identity Security System = "%System%\dttakby.exe"
It registers as a system service to ensure its automatic execution at every system startup by adding the following registry keys:
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\Awareness Desktop Security WMI Transaction
ImagePath = "%System%\dttakby.exe"
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\Awareness Desktop Security WMI Transaction
DisplayName = "Awareness Desktop Security WMI Transaction"
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\Awareness Desktop Security WMI Transaction
Start = "2"
Other System Modifications
This Trojan adds the following registry keys:
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Enum\Root\LEGACY_AWARENESS_DESKTOP_SECURITY_WMI_TRANSACTION
It adds the following registry entries:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
FirewallDisableNotify = "1"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
FirewallOverride = "1"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
AntiVirusDisableNotify = "1"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
AntiVirusOverride = "1"
HOSTS File Modification
This Trojan overwrites the HOSTS file in the following locations:
- %System%\drivers\etc\host (On Windows 2000, XP, and Server 2003)
NOTES:
It connects to a set of random domains.