Home Malware Programs Trojans Pigeon AZNZ

Pigeon AZNZ

Posted: May 19, 2009

Pigeon AZNZ, which has been dubbed Infostealer by Symantec, Packed.Win32.Klone.bh by Kaspersky, Generic Packed.e by McAfee, and W32/Hupigon.ARY.dropper by Norman, is a backdoor Trojan that sneaks onto your system through secret security exploits and vulnerabilities. Once Pigeon AZNZ is installed and active, this trojan may download additional malware and adware onto your system.

File System Modifications

  • The following files were created in the system:
    # File Name
    1 dll1[1].exe
    2 hacker.com.cn.exe

Registry Modifications

  • The following newly produced Registry Values are:
    HKEY..\..\..\..{RegistryKeys}HKEY_LOCAL_MACHINE\system\currentcontrolset\enum\root\legacy_graypigeon_HKEY_LOCAL_MACHINE\system\currentcontrolset\enum\root\legacy_graypigeon_ nextinstanceHKEY_LOCAL_MACHINE\system\currentcontrolset\enum\root\legacy_graypigeon_\0000HKEY_LOCAL_MACHINE\system\currentcontrolset\enum\root\legacy_graypigeon_\0000 classHKEY_LOCAL_MACHINE\system\currentcontrolset\enum\root\legacy_graypigeon_\0000 classguidHKEY_LOCAL_MACHINE\system\currentcontrolset\enum\root\legacy_graypigeon_\0000 configflagsHKEY_LOCAL_MACHINE\system\currentcontrolset\enum\root\legacy_graypigeon_\0000 devicedescHKEY_LOCAL_MACHINE\system\currentcontrolset\enum\root\legacy_graypigeon_\0000 legacyHKEY_LOCAL_MACHINE\system\currentcontrolset\enum\root\legacy_graypigeon_\0000 serviceHKEY_LOCAL_MACHINE\system\currentcontrolset\enum\root\legacy_graypigeon_\0000\controlHKEY_LOCAL_MACHINE\system\currentcontrolset\enum\root\legacy_graypigeon_\0000\control activeserviceHKEY_LOCAL_MACHINE\system\currentcontrolset\services\graypigeon_HKEY_LOCAL_MACHINE\system\currentcontrolset\services\graypigeon_ descriptionHKEY_LOCAL_MACHINE\system\currentcontrolset\services\graypigeon_ displaynameHKEY_LOCAL_MACHINE\system\currentcontrolset\services\graypigeon_ errorcontrolHKEY_LOCAL_MACHINE\system\currentcontrolset\services\graypigeon_ imagepathHKEY_LOCAL_MACHINE\system\currentcontrolset\services\graypigeon_ objectnameHKEY_LOCAL_MACHINE\system\currentcontrolset\services\graypigeon_ startHKEY_LOCAL_MACHINE\system\currentcontrolset\services\graypigeon_ typeHKEY_LOCAL_MACHINE\system\currentcontrolset\services\graypigeon_\enumHKEY_LOCAL_MACHINE\system\currentcontrolset\services\graypigeon_\enum 0HKEY_LOCAL_MACHINE\system\currentcontrolset\services\graypigeon_\enum countHKEY_LOCAL_MACHINE\system\currentcontrolset\services\graypigeon_\enum nextinstanceHKEY_LOCAL_MACHINE\system\currentcontrolset\services\graypigeon_\securityHKEY_LOCAL_MACHINE\system\currentcontrolset\services\graypigeon_\security security
Loading...