BKDR_CARBANAK.C

它以其他(tā)恶意软件释放的文(wén)件或用(yòng)户访问恶意网站时不知不觉下载的文(wén)件的形式到达系统。它开始执行然后再删除。

安(ān)装(zhuāng)

它在受感染的系统中(zhōng)植入下列自身副本：

• %All Users Profile%\Application Data\Mozilla\svchost.exe - for Windows XP and prior OS versions
• %ProgramData%\Mozilla\svchost.exe - for Windows Vista and later OS versions

它创建下列文(wén)件夹：

• %All Users Profile%\Application Data\Mozilla - for Windows XP and later OS versions
• %ProgramData%\Mozilla - for Windows 7 and later OS versions

它向下列进程中(zhōng)注入代码：

• created svchost.exe

自启动技(jì )术

它通过添加下列注册表项，注册為(wèi)系统服務(wù)，确保在每次系统启动时自动执行：

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\{random service name}Sys
ImagePath = "%ProgramData%\Mozilla\svchost.exe - for Windows Vista and later OS versions"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\{random service name}Sys
ImagePath = "%All Users Profile%\Application Data\Mozilla\svchost.exe - for Windows XP and prior OS versions"

它通过添加下列注册表键值注册為(wèi)系统服務(wù)，确保在每次系统启动时自动执行:

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\{random service name}Sys

后门例程

它执行遠(yuǎn)程恶意用(yòng)户的下列命令：

• Capture and send screenshots
• Capture and send video
• Download configuration file
• Download and execute arbitrary files
• Download third party remote desktop protocol software that will be used for remote access
• Update itself
• Restart the machine
• Check state of malware

它连接到下列网站，发送和接收信息：

• http://{BLOCKED}.{BLOCKED}.167.28:443

它将下列信息发送到其命令和控制 (C&C) 服務(wù)器:

• OS version
• number of processors
• computer name
• username
• current time

其他(tā)详细信息

它植入下列文(wén)件/组件：

• %All Users Profile%\Application Data\Mozilla\{random file name}.bin - for Windows XP and prior OS versions
• %Program Data%\Mozilla\{random file name}.bin - for Windows Vista and laterr OS versions

它在执行后自行删除。