Home Malware Programs Remote Administration Tools Beast

Beast

Posted: March 28, 2006

Beast is a backdoor Trojan or RAT that was designed to target Windows versions from Win 95 up to Windows XP. Along with standard types of Remote Administration Tool functions that granted control of the infected PC to a criminal-operated server, Beast also became newsworthy due to its inclusion of reverse connection features that evaded traditional firewall security. Although Beast's development halted in 2004, vulnerable versions of Windows can still be harmed by Beast, which, as a result of its innovative and powerful security-attacking features, was extremely popular in its heyday. SpywareRemove.com malware experts recommend that you use anti-malware software to delete Beast, since Beast infects multiple locations on your PC and can inject its code into normal Windows processes.

Beast: a Well-Aged Wild Thing That Could Still Be on the Prowl

Beast was a Tataye-developed Trojan that, like others of its kind, was built for the express purpose of compromising a PC's security and allowing criminals to gain access to it for any of a number of nefarious ends. While Beast was well-designed and included a number of different features in its structure, SpywareRemove.com malware researchers have taken particular care to note Beast's main attacks, which are still relevant to today's PC users:

  • Beast can generate fake error messages to make it appear as though dysfunctions on your computer are related to other infections – or to create new problems out of thin air to confuse its victims.
  • Criminals in contact with the Beast's configured C&C server can have almost limitless access to your PC. This access includes the ability to rename files, delete them, launch them, upload/download them or move them to other locations.
  • Beast also includes a whole host of spyware-based functions for the theft of personal information. Beast may steal form-based data, take screenshots, monitor your webcam or use keylogging attacks that log your keyboard input.
  • Beast can also attack the Windows interface in several ways, such as by locking your mouse, hiding the Windows taskbar or changing your desktop image.

Putting the Big Bad Beast to Sleep

Along with non-Windows OSes, versions of Windows past XP can't be infected by Beast. However, if you're still using Windows 95, Windows XP or any OS between those two versions, Beast still is capable of compromising your computer's security and installing other PC threats, stealing private information or conducting other attacks. Because Beast's attacks can alter components of Windows, including the Registry, SpywareRemove.com malware experts recommend that you have anti-malware software remove Beast and its changes whenever it's necessary.

There aren't any symptoms involved in a Beast infection, although some of the Beast's attacks may cause symptoms (such as browser hijacks or visible changes to Windows). Because Beast was widely-distributed in its day and can be reconfigured for many types of attacks, you should consider the worst possibilities and remove Beast hastily once Beast is detected.

File System Modifications

  • The following files were created in the system:
    # File Name
    1 92e56c9f.exe
    2 9d6680f5.exe
    3 [system
    4 beast
    5 beast.exe
    6 beast192.exe
    7 beast2.00.exe
    8 beast2.01.exe
    9 beast2.01_french_tuto.chm
    10 beast2.06.exe
    11 beastnbl.com
    12 comsv.com
    13 dxdgns.dll
    14 frenchtuto.doc
    15 hlir.blf
    16 hservms.exe
    17 kb.tlg
    18 kd.txs
    19 kl.dli
    20 kl.tti
    21 msaria.com
    22 msbeku.com
    23 msbwdr.com
    24 msbxbs.com
    25 mscom32.com
    26 msdgqt.com
    27 msdvnp.com
    28 mshiye.com
    29 mshlir.com
    30 mshost.exe
    31 msisai.com
    32 msndxp.com
    33 msocge.com
    34 msoksw.com
    35 mspfgf.com
    36 msqlxh.com
    37 msqmqr.com
    38 msujop.com
    39 mswnqu.com
    40 msyrmu.com
    41 oksw.blf
    42 readme.nfo
    43 readme.txt
    44 server.exe
    45 shell32.com
    46 tutorial.pdf
    47 ujop.blf
    48 wb.com
    49 wsv.com
    50 yrmu.blf

Registry Modifications

  • The following newly produced Registry Values are:
    HKEY..\..\..\..{RegistryKeys}HKEY_CLASSES_ROOT.badHKEY_CLASSES_ROOTeastfileHKEY_CLASSES_ROOTeastfile1HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionas096941-b967-10d8-9cbd-0000f87a369estubpath

Related Posts

Loading...