Home Malware Programs Backdoors Backdoor.Prioxer.C

Backdoor.Prioxer.C

Posted: October 8, 2013

Threat Metric

Ranking: 19,488
Threat Level: 1/10
Infected PCs: 874
First Seen: October 8, 2013
Last Seen: December 12, 2024
OS(es) Affected: Windows

Backdoor.Prioxer.C is a backdoor Trojan that opens a back door on the affected computer. When Backdoor.Prioxer.C is executed, it will check for a 32-bit environment to continue, or it will terminate. Backdoor.Prioxer.C may create registry entries on the corrupted PC. Backdoor.Prioxer.C may also delete registry entries. Backdoor.Prioxer.C may take over one of the services found in following registry subkey. Backdoor.Prioxer.C may delete the file recorded in the certain registry entity. Backdoor.Prioxer.C then deletes the registry entity. Backdoor.Prioxer.C opens a back door on the targeted computer and connects to the particular web address. Backdoor.Prioxer.C may then carry out the potentially malevolent actions such as download, execute and manage files, gather system information, manage system processes and registry entries, shutdown the computer and clear events log.

Technical Details

Registry Modifications

The following newly produced Registry Values are:

HKEY..\..\{Value}HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\[COMPROMISED SERVICE NAME]\"DependOnService" = ""HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\"ie" = "[RANDOM CHARACTERS]\[RANDOM CHARACTERS].exe"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\[COMPROMISED SERVICE NAME]\"Start" = "4"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\"id" = "[HEXIDECIMAL NUMBER]"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\"it" = "[BINARY DATA]"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\"svcname" = "[COMPROMISED SERVICE NAME]"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Btr\"Run" = "[BINARY DATA]"HKEY..\..\..\..{Subkeys}HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\"ie"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost

Additional Information

The following URL's were detected:
"jquery.js", "sviluppotjopes/testdianima.js"
Loading...