Home Malware Programs Backdoors Zagaban

Zagaban

Posted: March 28, 2006

Zagaban is a backdoor designed to run a hidden proxy server on a compromised PC. The threat is controlled by the remote attacker. He is allowed to reconfigure Zagaban and integrated proxy and modify the computer Hosts file in order to block access to certain Internet resources or send the user to undesirable web sites. Zagaban is able to hide its active processes. The backdoor automatically runs on every Windows startup.

File System Modifications

  • The following files were created in the system:
    # File Name
    1 gld.dll
    2 gld.exe
    3 hosts.dll
    4 socks.dll

Registry Modifications

  • The following newly produced Registry Values are:
    HKEY..\..\..\..{RegistryKeys}HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsNTCurrentVersionWinlogonShell=explorer.exe%System%gld.exe
Loading...