Win32/Redosdru [Threat Name] go to Threat
Win32/Redosdru.BL [Threat Variant Name]
Category | trojan |
Size | 124104 B |
Aliases | Trojan.Win32.Agent.djfg (Kaspersky) |
Backdoor:Win32/Zegost.B (Microsoft) | |
Generic.dx!ntd.trojan (McAfee) |
Short description
Win32/Redosdru.BL installs a backdoor that can be controlled remotely. The file is run-time compressed using UPX .
Installation
The trojan replaces file(s) referenced by the following Registry entries with its own copy or with another malware file:
- [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost\netsvcs]
It avoids files which contain any of the following strings in their path:
- 6to4
- iprip
- nwsaPAgEnT
The following Registry entries are set:
- [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\%servicename%]
- "Start" = %variable1%
- "Type" = %variable2%
- [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\%servicename%\Enum]
- "0" = "Root\LEGACY_%servicename%\0000"
- "Count" = %variable3%
- "NextInstance" = %variable4%
- [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_%servicename%]
- "NextInstance" = %variable5%
- [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_%servicename%\0000]
- "Service" = "%servicename%"
- "Legacy" = %variable6%
- "ConfigFlags" = %variable7%
- "Clas" = "%variable8%"
- "ClassGuid" = "%variable9%"
- "DeviceDesc" = "%variable10%"
- [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_%servicename%\0000\Control]
- "*NewlyCreated*" = %variable11%
- "ActiveService" = "%servicename%"
- [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\%servicename%\Parameters]
- "ServiceDll" = "%originalservicepath%"
- "servicemain" = "UPSStop"
- "paramet" = "%originalservicepath%"
A string with variable content is used instead of %variable1-11% .
This causes the trojan to be executed on every system start.
The trojan creates the following files:
- %temp%\%random%.log (155648 B)
- %appdata%\Microsoft\Windows\%random%\%random%.dll (155648 B)
- "%programfiles%\NetMeeting\%random%.lib" (155648 B)
- "%system%\96C52968.key
A string with variable content is used instead of %random% .
Other information
The trojan acquires data and commands from a remote computer or the Internet.
The trojan contains a list of (1) URLs. The TCP protocol is used.
It can execute the following operations:
- update itself to a newer version
- block keyboard and mouse input
- set file attributes
- steal information from the Windows clipboard
- send files to a remote computer
- sending various information about the infected computer
- send the list of running processes to a remote computer
- send the list of disk devices and their type to a remote computer
- remove itself from the infected computer
- open a specific URL address
- move files
- run executable files
- download files from a remote computer and/or the Internet
- terminate running processes
- delete folders
- delete cookies
- delete Registry entries
- create folders
- capture screenshots
- create Registry entries
- shut down/restart the computer
- log keystrokes
- capture webcam video/voice
- show/hide application windows
The following information is collected:
- network adapter information
- computer name
- memory status
- CPU information
- operating system version
The trojan can send the information to a remote machine.