Bredolab.gen.d

This page shows details and results of our analysis on the malware Bredolab.gen.d

Download Current DAT: 6616

Threat Detail

Malware Type: Trojan

Malware Sub-type: Generic

Discovery Date: 2009-10-16

Next Steps:

Overview
Characteristics
Symptoms
Method of Infection
Removal

Overview

This is a Trojan detection. Unlike viruses, Trojans do not self-replicate. They are spread manually, often under the premise that they are beneficial or wanted. The most common installation methods involve system or security exploitation, and unsuspecting users manually executing unknown programs. Distribution channels include email, malicious or hacked web pages, Internet Relay Chat (IRC), peer-to-peer networks, etc.

Aliases

Kaspersky - Packed.Win32.Krap.x

NOD32 - a variant of Win32/Kryptik.AVV

Symantec - Trojan.FakeAV!gen4

AVG - Packed.Revolt

Minimum DAT

5773 (2009-10-16)

Updated DAT

5916 (2010-03-10)

Minimum Engine

5.2.00

File Length

N/A

Description Added

2009-10-17

Description Modified

2009-10-22

Malware Proliferation

Characteristics

Registers an Inprocserver to execute the DLL after reboot

Registers a Browser Helper Object (BHO) to perform malicious actions

Upon execution the Trojan creates the following files:

%WinDir%\system32\bhdvgtueyitf.dll [Detected as Downloader-BNY]
%WinDir%\system32\sys.dat [Detected as Downloader-BNY]

The Following registry elements have been added:

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{92016F88-97B2-4C4A-91C9-F1A6EFDB2D12}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{92016F88-97B2-4C4A-91C9-F1A6EFDB2D12}\InProcServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{92016F88-97B2-4C4A-91C9-F1A6EFDB2D12}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{92016F88-97B2-4C4A-91C9F1A6EFDB2D12}\InProcServer32\: "%SystemRoot%\system32\bhdvgtueyitf.dll"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{92016F88-97B2-4C4A-91C9- F1A6EFDB2D12} \InProcServer32\ThreadingModel: "Apartment"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{92016F88-97B2-4C4A-91C9-F1A6EFDB2D12}\: "Microsoft Online Helper!"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{92016F88-97B2-4C4A-91C9-F1A6EFDB2D12}\: "Microsoft Online Helper!"
HKEY_USERS\S-1-5-21-1454471165-926492609-839522115-500\Software\Microsoft\Internet Explorer\Main\^%\E$@@#n%^a&^()%b#(^$%l%(^%$e(^&^%\#$%r$$^%o$#(%w@$%#$s%^^%$e%^(()(*& %#E*&^&x$(%%t%$#$@e^^%@(n#$%s))#%i*^o$%$^$^n(&*s(%^&: "yes"

[Where %WinDir% is the Windows Directory - for example c:\windows]

Symptoms

Existence of above mentioned files and Registry keys

Method of Infection

Trojans do not self-replicate. They are spread manually, often under the premise that the executable is something beneficial. Distribution channels include IRC, peer-to-peer networks, newsgroup postings, email spam, etc.

Removal

All Users:
Use current engine and DAT files for detection and removal.

Modifications made to the system Registry and/or INI files for the purposes of hooking system startup, will be successfully removed if cleaning with the recommended engine and DAT combination (or higher).