Home Malware Programs Backdoors Backdoor.Kopdel

Backdoor.Kopdel

Posted: September 27, 2013

Threat Metric

Threat Level: 2/10
Infected PCs: 1
First Seen: September 27, 2013
OS(es) Affected: Windows

Backdoor.Kopdel is a backdoor Trojan that opens a back door on the infected computer and may download potentially malicious files. Backdoor.Kopdel may be dropped and installed by other PC threats. When executed, Backdoor.Kopdel creates the registry entries (The [SERVICE NAME] inserted in the registry entries may be 'Windows Debug System Management Interface'. Backdoor.Kopdel may connect to the certain web address. Backdoor.Kopdel may download and run potentially malicious files from the remote server.

Technical Details

Registry Modifications

The following newly produced Registry Values are:

HKEY..\..\{Value}HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\[SERVICE NAME]\0000\"Class" = "LegacyDriver"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\[SERVICE NAME]\"NextInstance" = 0x00000001HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\[SERVICE NAME]\0000\"ConfigFlags" = 0x00000000HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\[SERVICE NAME]\0000\"ClassGUID" = "[GUID]"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\[SERVICE NAME]\0000\"Legacy" = 0x00000001HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\[SERVICE NAME]\0000\"DeviceDesc" = "[SERVICE NAME]"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\[SERVICE NAME]\"Description" = "Provides Interfaces for Windows Debug and Error Handle"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\[SERVICE NAME]\0000\"Service" = "[SERVICE NAME]"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\[SERVICE NAME]\"ErrorControl" = 0x00000001 HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\[SERVICE NAME]\"DisplayName" = "[SERVICE NAME]"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\[SERVICE NAME]\"ErrorPointer" = [BINARY CONTENT]HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\[SERVICE NAME]\"ErrorHandle" = "120"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\[SERVICE NAME]\"ImagePath" = "%WORKINGDIRECTORY%\%SAMPLENAME%.exe""HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\[SERVICE NAME]\"ImagePath" = "%WORKINGDIRECTORY%\%SAMPLENAME%"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\[SERVICE NAME]\"Start" = 0x00000002HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\[SERVICE NAME]\"ObjectName" = "LocalSystem"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\[SERVICE NAME]\Security\"Security" = [BINARY CONTENT]HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\[SERVICE NAME]\"Type" = 0x00000010

Additional Information

The following URL's were detected:
[http://]kartmanscript.com/_upda[REMOVED]
The following messages's were detected:
# Message
1The [SERVICE NAME] may be "Windows Debug System Management Interface".

Loading...