arrow_back
search
close

BKDR_KELIHOS.SMN

April 24, 2015
 ALIASES:

Backdoor:Win32/Kelihos.F(Microsoft), Mal/Vawtrak-H(Sophos), Backdoor.Win32.Kelihos(Ikarus)

 PLATFORM:

Windows

 OVERALL RISK RATING:
 DAMAGE POTENTIAL:
 DISTRIBUTION POTENTIAL:
 REPORTED INFECTION:
 INFORMATION EXPOSURE:

  • Threat Type: Backdoor

  • Destructiveness: No

  • Encrypted:

  • In the wild: Yes

  OVERVIEW

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

  TECHNICAL DETAILS

File Size:

1,201,152 bytes

File Type:

EXE

Memory Resident:

Yes

Initial Samples Received Date:

08 Mar 2013

Arrival Details

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Autostart Technique

This backdoor adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
{random parameter 1}{random parameter 2} = "{malware path and file name}"

Other Details

This backdoor connects to the following possibly malicious URL:

  • {BLOCKED}.{BLOCKED}.184.240
  • {BLOCKED}.{BLOCKED}.147.4
  • {BLOCKED}.{BLOCKED}.47.100
  • {BLOCKED}.{BLOCKED}.60.16
  • {BLOCKED}.{BLOCKED}.147.4
  • {BLOCKED}.{BLOCKED}.59.229
  • {BLOCKED}.{BLOCKED}.199.6
  • {BLOCKED}.{BLOCKED}.98.141
  • {BLOCKED}.{BLOCKED}.184.240
  • {BLOCKED}.{BLOCKED}.86.4

NOTES:

This backdoor modifies its file attributes to read-only and hidden after execution.

The auto-run registry, {random parameter 1} can be any of the following:

  • Network
  • Time
  • CrashReport
  • Database
  • Icon
  • Desktop
  • Tray
  • Video
  • Media

The auto-run registry, {random parameter 2} can be any of the following:

  • Checker
  • Informer
  • Notifyer
  • Saver
  • Updater
  • Verifyer

For example:

  • NetworkVerifyer
  • TrayNotifyer
  • CrashReportUpdater