A forum for reverse engineering, OS internals and malware analysis 

Malware/MSIL-BA

Forum for analysis and discussion about malware.

Re: Worm.Win32.Bybz

 #3928  by EP_X0FF
 Sat Dec 11, 2010 1:27 pm
Yet another .NET framework based trojan.

Drops CCleaner.exe to system.

Runs through HKCU\Software\Microsoft\Windows\CurrentVersion\Run as c:\documents and settings\UserName\application data\cdnlgjkryqyoupqotflsik\cdnlgjkryqyoupqotflsik\0.0.0.0\ccleaner.exe

Turns off System Restore, TaskManager, MSConfig, Regedit.

from the inside
Software\Microsoft\Windows\CurrentVersion\Run

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
EnableBalloonTips
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System
DisableTaskMgr
DisableRegistryTools

HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System
DisableCMD

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\SystemRestore
DisableSR

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
DisallowRun msconfig.exe
Attachments
pass: malware
(219 KiB) Downloaded 66 times

Re: Mal/MSIL-BA

 #4203  by EP_X0FF
 Thu Dec 30, 2010 4:20 pm
Crashes at start (Index was outside the bounds of the array).
 Return to “Malware”