Full description

Virus:	TR/Kazy.30847.7
Date discovered:	14/07/2011
Type:	Trojan
In the wild:	Yes
Reported Infections:	Low
Distribution Potential:	Low
Damage Potential:	Medium
Static file:	Yes
VDF version:	7.11.11.129 - Thursday, July 14, 2011
IVDF version:	7.11.11.129 - Thursday, July 14, 2011

General Method of propagation:
   • No own spreading routine

Aliases:
   • Kaspersky: Trojan.Win32.Jorik.Gbot.czt
   • TrendMicro: BKDR_CYCBOT.SME3
   • Microsoft: Backdoor:Win32/Cycbot.B

Platforms / OS:
   • Windows 2000
   • Windows XP
   • Windows 2003
   • Windows Vista
   • Windows 7

Side effects:
   • Drops files
   • Registry modification
   • Steals information

Files It copies itself to the following location:
• %APPDATA%\Microsoft\conhost.exe

The following file is created:

– %APPDATA%\Microsoft\stor.cfg

Registry One of the following values is added in order to run the process after reboot:

– [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
   • "conhost"="%APPDATA%\Microsoft\conhost.exe"

The following registry key is added:

– [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
   • "ProxyServer"="http=127.0.0.1:%number%"

The following registry keys are changed:

– [HKLM\SYSTEM\ControlSet001\Hardware Profiles\0001\Software\
   Microsoft\windows\CurrentVersion\Internet Settings]
   New value:
   • "ProxyEnable"=dword:00000001

– [HKLM\SYSTEM\ControlSet001\Hardware Profiles\Current\Software\
   Microsoft\windows\CurrentVersion\Internet Settings]
   New value:
   • "ProxyEnable"=dword:00000001

– [HKLM\SYSTEM\CurrentControlSet\Hardware Profiles\0001\Software\
   Microsoft\windows\CurrentVersion\Internet Settings]
   New value:
   • "ProxyEnable"=dword:00000001

– [HKLM\SYSTEM\CurrentControlSet\Hardware Profiles\Current\Software\
   Microsoft\windows\CurrentVersion\Internet Settings]
   New value:
   • "ProxyEnable"=dword:00000001

– [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
   New value:
   • "ProxyEnable"=dword:00000001

Backdoor The following port is opened:

– %executed file% on a random TCP port in order to provide a proxy server.

Contact server:
The following:
• http://**********stats.com/images/logo.png?tq=gF**********

File details Runtime packer:
In order to aggravate detection and reduce size of the file it is packed with a runtime packer.

설명 삽입자 Andrei Ilie 2011년 11월 1일 화요일
설명 업데이트 Andrei Ivanes 2011년 11월 4일 금요일

뒤로 . . . .

내 계정