Home / malwarePDF  

Win32/Xyligan.B


First posted on 05 April 2015.
Source: SecurityHome

Aliases :

There are no other names known for Win32/Xyligan.B.

Explanation :

Backdoor:Win32/Xyligan.B is a trojan that allows unauthorized access and control of an affected computer.

Installation
When executed, Backdoor:Win32/Xyligan.B copies itself to ipjzzn.exe.

Note: refers to a variable location that is determined by the malware by querying the Operating System. The default installation location for the System folder for Windows 2000 and NT is C:WinntSystem32; and for XP, Vista, and 7 is C:WindowsSystem32.

Payload
Modifies system security settings
Backdoor:Win32/Xyligan.B adds itself to the list of applications that are authorized to access the Internet without being stopped by the Firewall, by making the following registry modification:

Adds value: "C:WINDOWSsystem32ipjzzn.exe"
With data: "c:windowssystem32ipjzzn.exe:*:enabled:microsoft (r) internetal iexplore"
To subkey: HKLMSYSTEMCurrentControlSetServicesSharedAccessParametersFirewallPolicyStandardProfileAuthorizedApplicationsList

Allows backdoor access and control
The malware allows unauthorized access and control of an affected computer. An attacker can perform any number of different actions on an affected computer using Backdoor:Win32/Xyligan.B. This could include, but is not limited to, the following actions:


  • Download and execute arbitrary files

  • Upload files

  • Spread to other computers using various methods of propagation

  • Log keystrokes or steal sensitive data

  • Modify system settings

  • Run or terminate applications

  • Delete files


This malware description was produced and published using our automated analysis system's examination of file SHA1 1723a1c326fff28fd05071146270883847053581.


Symptoms
System changes
The following system changes may indicate the presence of this malware:
  • The presence of the following files:
    ipjzzn.exe

  • The presence of the following registry modifications:
    Adds value: "C:WINDOWSsystem32ipjzzn.exe"
    With data: "c:windowssystem32ipjzzn.exe:*:enabled:microsoft (r) internetal iexplore"
    To subkey: HKLMSYSTEMCurrentControlSetServicesSharedAccessParametersFirewallPolicyStandardProfileAuthorizedApplicationsList

Last update 05 April 2015

 

TOP

Malware :