 |
|
 |
|
DizzyX
Administrator
Data inscrierii: 16/Iul/2008
Mesaje: 48
|
|
 |
|
 |
|
 Trimis: 16/07/2008 01:43 Titlul subiectului: Trojan.Dropper.Delf.BAS |
 |
|
Trojan.Dropper.Delf.BAS
Raspandire : nespus de scazut
Dauna : foarte scazut
Size: approx 33200 bytes
Descoperit : 2008 Jun 26
SYMPTOMS:
Presence of more than one instance of an executable that does different things.
TECHNICAL DESCRIPTION:
This file usually comes bundled with other types of malware. The file analyzed came with Backdoor.Agent.ZHQ. When executed the dropper first resolves its imports and after that checks to see if it is being ran by a virus analyst. It checks to see if the value HKCU\Control Pane\SwapMouseButtons is set, it checks for the existence of the folder Parallels tools in C:\Program Files\Parallels, checks to see if the file name is file.exe or sample.exe and finally checks to see if it can obtain an handle to SpieDll.dll. If none of the condition was fulfilled, it goes on decrypting the executable files from its resource section.
For each decompressed file it creates a suspended process and overwrites the image of the process with the file which it just decompressed. It then resumes the process. |
|
FAQ 
Mesaje private 
