Home / malware

PDF

TrojanDownloader:Win32/Badiehi.B

First posted on 07 October 2015.
Source: Microsoft

Aliases :

There are no other names known for TrojanDownloader:Win32/Badiehi.B.

Explanation :

Threat behavior

Installation
This threat can create files on your PC, including:

• %ProgramFiles%\baidu\bind.exe
• %ProgramFiles%\baidu\pps.exe
• %ProgramFiles%\baidu\unins000.dat
• %ProgramFiles%\baidu\unins000.exe
• %TEMP%\setup3.exe

It modifies the registry so that it runs each time you start your PC. For example:

In subkey: HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Sets value: "apphide"
With data: "%ProgramFiles%\baidu\pps.exe"

Payload


Downloads malware or unwanted software

This threat can download other malware and unwanted software onto your PC from the following sites:

• czzsyzgm.com
• czzsyzgz.com
• czzsyzxl.com

This malware description was published using automated analysis of file SHA1 a30e0405040b94374ffe277eaf0a996d861c7f26.

Symptoms

The following can indicate that you have this threat on your PC:

• You see a file similar to:
  • %ProgramFiles%\baidu\bind.exe
  • %ProgramFiles%\baidu\pps.exe
  • %ProgramFiles%\baidu\unins000.dat
  • %ProgramFiles%\baidu\unins000.exe
  • %TEMP%\setup3.exe

• You see registry modifications such as:
• In subkey: HKCU\Software\Microsoft\Windows\CurrentVersion\Run
  Sets value: "apphide"
  With data: "%ProgramFiles%\baidu\pps.exe"

Last update 07 October 2015

 

TOP