This Trojan offers a remote malicious user full control over the victim machine.
The Trojan itself is a Windows PE EXE file, approximately 85KB in size, packed using MEW. The unpacked file is approximately 352KB in size.
Once launched, the backdoor copies itself to the Windows system directory as “dllmanager.exe”.
%System%\dllmanager.exe
It then registers this file in the system registry:
[HKLM\Software\Microsoft\Windows\CurrentVersion\Run]
"NvCplScan" = "dllmanager.exe"
[HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"NvCplScan" = "dllmanager.exe"
[HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices]
"NvCplScan" = "dllmanager.exe"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"NvCplScan" = "dllmanager.exe"
[HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"NvCplScan" = "dllmanager.exe"
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"NvCplScan" = "dllmanager.exe"
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"NvCplScan" = "dllmanager.exe"
This ensures that a copy of the malicious program will be launched each time
the victim machine is rebooted.
The backdoor connects to an IRC server in order to receive commands.
Once it has established a connection to an IRC server, a malicious remote
user can cause the Trojan to scan other computers for unprotected network resources,
and for the LSASS vulnerability. It can then install itself on vulnerable machines,
and upload files to these machines. It is also capable of: deleting files, terminating
a range of processes, extracting CD registration codes, harvesting email addresses,
logging key strokes, carrying out DOS attacks, installing updated versions of
the Trojan on the victim machine, and harvesting information about the infected
machine and its owner.
Check out if we have free removal tool for this virus
