Virus: BDS/Bot.145845 Date discovered: 10/11/2011 Type: Backdoor Server In the wild: No Reported Infections: Low to medium Distribution Potential: Low Damage Potential: Medium Static file: Yes File size: 73.728 Bytes MD5 checksum: EE2DC1DC7CCA53CE57015D6564DA2243 VDF version: 7.11.17.126 - Thursday, November 10, 2011IVDF version: 7.11.17.126 - Thursday, November 10, 2011
General Method of propagation: Aliases: Platforms / OS: Files %random character string% .exe%TEMPDIR% \google_cachepages2.tmp This is a non malicious text file with the following content:%seven-digit random character string% .exe Furthermore this file gets executed after it was fully downloaded. %seven-digit random character string% .exe %seven-digit random character string% .exe %seven-digit random character string% .exe %seven-digit random character string% .exe %seven-digit random character string% .exe %seven-digit random character string% .exe %seven-digit random character string% .exe %seven-digit random character string% .exe %seven-digit random character string% .exe %seven-digit random character string% .exe Furthermore this file gets executed after it was fully downloaded. Further investigation pointed out that this file is malware, too. Detected as: TR/Offend.kdv.404824.6 %seven-digit random character string% .exe %seven-digit random character string% .exe %seven-digit random character string% .exe %seven-digit random character string% .exe %seven-digit random character string% .exe %seven-digit random character string% .exe %seven-digit random character string% .exe Registry %SYSDIR% \userinit.exe,%malware execution directory% \%executed file% .exe -init%random character string% .exe -tman Backdoor Contact server: Sends information about: Remote control capabilities: Injection Miscellaneous Mutex: File details Programming language: The malware program was written in MS Visual C++.
Description inserted by Ana Maria Niculescu on Tuesday, November 15, 2011
Back
.
.
.
.
