Home Malware Programs Backdoors Bebshell

Bebshell

Posted: March 28, 2006

Bebshell is a backdoor that provides the attacker with unauthorized remote access to the compromised PC. The intruder can manipulate files, start and end processes, log keystrokes and send e-mail messages. The backdoor also allows to steal e-mail account details, retrieve network and drive information and modify computer configuration by altering the Windows registry. Bebshell runs on every Windows startup.

Bebshell is usually installed through the WMF exploit .

File System Modifications

  • The following files were created in the system:
    # File Name
    1 webshell.dll
    2 winlog.dll
    3 wjan20.doc

Registry Modifications

  • The following newly produced Registry Values are:
    HKEY..\..\..\..{RegistryKeys}HKEY_CLASSES_ROOTCLSID[randomstring]InProcServer32(Default)=%System%webshell.dllHKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionShellServiceObjectDelayLoadwebshell
Loading...