Home / malware

PDF

Backdoor:W32/Bredavi

First posted on 27 April 2010.
Source: SecurityHome

Aliases :

There are no other names known for Backdoor:W32/Bredavi.

Explanation :

A remote administration utility that bypasses normal security mechanisms to secretly control a program, computer or network.

Additional DetailsThis page encompasses the Family Description for Backdoor:W32/Bredavi. Bredavi is a Remote Administration Tool (RAT) that can be exploited by remote users to gain control over a system on which the program is installed.

Installation process/actions

Upon its arrival in the system, the malware will check for its previous run on any of the targeted processes:

€ services.exe € iexplorer.exe € java.exe € javaw.exe € opera.exe
If the system is found clean with no traces that the malware has run on services.exe, the system will be infected then.

Using InterlockedExchange, the malware will hook the following functions:

€ From advapi32.dll - CryptEncrypt
€ From kernel32.dll - CreateFileW, GetFileAttributeExW
€ From ws2_32.dll - send, WSASend
€ From sks2xyz.dll (unknown dll that is believed to be its component) - vb_pfx_import
€ From User32.dll - GetWindowTextA

The malware will then look for iexplorer.exe, opera.exe, java.exe and javaw.exe, and injects itself in. It downloads a file from http://brendbar.cn/[...]n-bss.exe and saves it to '\\?\globalroot\systemroot\system32\ntfs_ext7.exe'.

It also makes a download from http://premiumbullets.cn/[...]php?id=!!. And, if "!killOS" string is found in the downloaded file, it terminates the following processes which are critical for the Windows operating system:

€ smss.exe € csrss.exe € lsass.exe € winlogon.exe

The malware modifies Windows host file to prevent the system from accessing domains that belongs to or affiliated with computer security companies.

Keylogger

The Bredavi malware contains a keylogger component, which surreptitiously monitors and stores all the strokes typed into the keyboard. For additional information on keylogger, please visit Encyclopedia: Keylogger.

Last update 27 April 2010

 

TOP