Win64/GoBot2 [Threat Name] go to Threat

Win64/GoBot2 [Threat Variant Name]

Category	trojan
Aliases	GoBotKR

Win64/GoBot2 serves as a backdoor. It can be controlled remotely.

The trojan copies itself into the %windir%, %appdata% folder with variable name.

The following Registry entries are set:

The trojan schedules a task that causes the following file to be executed on every system start:

In order to be executed on every system start, the trojan sets the following Registry entry:

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
- %variable2% = %malwarefilepath%

A string with variable content is used instead of %variable1-2% .

Win64/GoBot2 is a trojan that is spread via torrent files.

The trojan copies itself into the root folders of removable drives with variable name. The trojan creates the following files:

The AUTORUN.INF file contains the path to the malware executable.

The trojan collects the following information:

Win64/GoBot2 attempts to gain administrative privileges on the system.

Trojan is able to bypass User Account Control (UAC).

The trojan may execute the following commands:

The trojan executes the following files:

It may perform the following actions:

The HTTP, HTTPS protocol is used.

The trojan contains a URL address.

The trojan interferes with the operation of some security applications to avoid detection.

Trojan can detect presence of virtual environments and sandboxes.

The trojan terminates its execution if it detects that it's running in a specific virtual environment.