Backdoor.Win32.REMCOS.TICOGBZ

它以其他(tā)恶意软件释放的文(wén)件或用(yòng)户访问恶意网站时不知不觉下载的文(wén)件的形式到达系统。它开始执行然后再删除。

新(xīn)病毒详细信息

它以電(diàn)子邮件消息附件的形式出现，而此垃圾邮件由其他(tā)恶意软件/灰色软件/间谍软件或恶意用(yòng)户发送。

安(ān)装(zhuāng)

它在受感染的系统中(zhōng)植入下列自身副本：

• %User Profile%\Music\regdrv.exe
• %User Profile%\Videos\Regdriver.exe

(注意: %User Profile% 是当前用(yòng)户的概要文(wén)件文(wén)件夹，通常位于 C:\Windows\Profiles\{user name} (Windows 98 和 ME)、C:\WINNT\Profiles\{user name} (Windows NT) 和 C:\Documents and Settings\{user name} (Windows 2000、XP 和 Server 2003)。)

它植入下列文(wén)件：

• %User Temp%\aspr_keys.ini ← (to be deleted afterward)
• %User Profile%\Music\aspr_keys.ini ← (to be deleted afterward)
• %Application Data%\remcos\logs.dat← (component file)

(注意: %User Temp% 是当前用(yòng)户的 Temp 文(wén)件夹。通常位于 C:\Documents and Settings\{user name}\Local Settings\Temp (Windows 2000、XP 和 Server 2003)。. %User Profile% 是当前用(yòng)户的概要文(wén)件文(wén)件夹，通常位于 C:\Windows\Profiles\{user name} (Windows 98 和 ME)、C:\WINNT\Profiles\{user name} (Windows NT) 和 C:\Documents and Settings\{user name} (Windows 2000、XP 和 Server 2003)。. %Application Data% 是当前用(yòng)户的 Application Data 文(wén)件夹，通常位于 C:\Windows\Profiles\{user name}\Application Data (Windows 98 和 ME)、C:\WINNT\Profiles\{user name}\Application Data (Windows NT) 和 C:\Documents and Settings\{user name}\Local Settings\Application Data (Windows 2000、XP 和 Server 2003)。)

它植入和执行下列文(wén)件：

• %User Profile%\Music\regdrv.exe

(注意: %User Profile% 是当前用(yòng)户的概要文(wén)件文(wén)件夹，通常位于 C:\Windows\Profiles\{user name} (Windows 98 和 ME)、C:\WINNT\Profiles\{user name} (Windows NT) 和 C:\Documents and Settings\{user name} (Windows 2000、XP 和 Server 2003)。)

它添加下列互斥条目，确保一次只会运行一个副本：

• Remcos_Mutex_Inj
• explorer-{Random Characters}

自启动技(jì )术

它添加下列注册表项，在系统每次启动时自行执行：

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Registry Driver = %User Profile%\Videos\Regdriver.exe

其他(tā)系统修改

它添加下列注册表键值:

HKEY_CURRENT_USER\Software\explorer-{Random Characters}
lic = {Hex Values}

HKEY_CURRENT_USER\Software\explorer-{Random Characters}
exepath = {Hex Values}

后门例程

它执行遠(yuǎn)程恶意用(yòng)户的下列命令：

• Perform ping
• Enumerate drives
• List all files
• Open file/s
• Get file/s from affected computer
• Upload file/s to affected computer
• Delete file/s from affected computer
• Rename file/s from affected computer
• Create new directory
• Search a file from affected computer
• Download file from url
• Download file from local
• Enumerate process
• Terminate process
• Maximize/Minimize application
• Switch application
• Terminate application
• Open cmd
• Open webpage
• Open screen capture
• Open keylogger
• Set affected computer to send logs automatically
• Deletes cookies and stored browser logins
• Get screenshot
• Capture image from camera if available
• Capture voice from mic if available
• Acquire user password
• Display a messagebox to affected computer
• Sends keyboard input
• Sends mouse click
• Shutdown affected Computer
• Copy clipboard data
• Set clipboard data
• Clear clipboard data
• Manipulate registry entries