BKDR_ANDROM.YYSIZ
Troj/Androm-GI (Sophos); Win32/TrojanDownloader.Wauchos.BD (ESET-NOD32); Worm:Win32/Gamarue (Microsoft); TR/AD.Gamarue.Y.1838 (Avira)
Windows
Tipo de malware
Backdoor
Destructivo?
No
Cifrado
In the Wild:
Sí
Resumen y descripción
Detalles técnicos
Instalación
Crea las siguientes copias de sí mismo en el sistema afectado:
- %All Users Profile%\ms{random}.exe
Técnica de inicio automático
Agrega las siguientes entradas de registro para permitir su ejecución automática cada vez que se inicia el sistema:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\policies\
Explorer\Run
{random number} = "%All Users Profile%\ms{random}.exe"
Otras modificaciones del sistema
Agrega las siguientes entradas de registro:
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
Explorer
TaskbarNoNotification = "1"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\policies\
Explorer
TaskbarNoNotification = "1"
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
Explorer
HideSCAHealth = "1"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\policies\
Explorer
HideSCAHealth = "1"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\policies\
system
EnableLUA = "0"
Modifica las siguientes entradas de registro:
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
Hidden = "2"
(Note: The default value data of the said registry entry is "1".)
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
ShowSuperHidden = "0"
(Note: The default value data of the said registry entry is "1".)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
cval = "0"
(Note: The default value data of the said registry entry is "1".)
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
services\MpsSvc
Start = "4"
(Note: The default value data of the said registry entry is "2".)
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
services\SharedAccess
Start = "4"
(Note: The default value data of the said registry entry is "2".)
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
services\WinDefend
Start = "4"
(Note: The default value data of the said registry entry is "2".)
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\wscsvc
Start = "4"
(Note: The default value data of the said registry entry is "2".)
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\wuauserv
Start = "4"
(Note: The default value data of the said registry entry is "2".)