Home / malware

PDF

Backdoor:MSIL/Tzeebot.B

First posted on 17 December 2014.
Source: Microsoft

Aliases :

There are no other names known for Backdoor:MSIL/Tzeebot.B.

Explanation :

Threat behavior

Installation


It modifies the registry so that it runs each time you start your PC. For example:

In subkey: HKLM\software\microsoft\windows\currentversion\run

Sets value: "WindowsMediaPlayerUpdater"
With data: "0"

Payload


Allows backdoor access and control

This threat can give a malicious hacker access and control of your PC. They can then perform a number of different actions, including:

• Deleting files
• Downloading and running files
• Logging your keystrokes or stealing your sensitive data
• Modifying your system settings
• Running or stopping applications
• Uploading files

Additional information


This threat can create one or more mutexes on your PC. For example:

• demdaramdidam

It might use this mutex as an infection marker to prevent more than one copy of the threat running on your PC.

This malware description was published using automated analysis of file SHA1 085527aa52cc4556009f8121ee79c34805c0f1fc. Symptoms

The following can indicate that you have this threat on your PC:

• You see registry modifications such as:
  
  • In subkey: HKLM\software\microsoft\windows\currentversion\run
    Sets value: "WindowsMediaPlayerUpdater"
    With data: "0"

• You see a mutex such as:
  • demdaramdidam0
  • demdaramdidam208
  • demdaramdidam252
  • demdaramdidam256
  • demdaramdidam304
  • demdaramdidam4
  • demdaramdidam416
  • demdaramdidam480
  • demdaramdidam688
  • demdaramdidam700

Last update 17 December 2014

 

TOP