Home Malware Programs Worms Stekct

Stekct

Posted: May 18, 2012

Threat Metric

Threat Level: 5/10
Infected PCs: 5
First Seen: May 18, 2012
OS(es) Affected: Windows

Stekct is a worm that tries to use social networking websites and instant messaging programs such as AIM, MSN, Yahoo! Messenger, Google Talk, ICQ, Skype, Windows Live Messenger and Facebook to spread messages that contains a malware-laced link to a malicious file. Stekct displays the following message on the affected computer:

'HAHA LOL could this be you? hxxp://goo.gl/LFDt0?Facebook.com-IMG.JPG'

Stekct opens a backdoor that allows attackers to connect to the infected computer and perform numerous malicious actions such as dropping infectious files and running them, monitoring the IM programs and social networking websites for sending spam messages to the affected computer users' contacts. Stekct modifies the Windows Registry, so that it can run automatically every time you start windows. Stekct inserts itself to the list of legitimate processes which become authorized to access the network just by changing another registry value. Stekct also attempts to block anti-virus software processes and services. Stekct attempts to terminate processes and delete all the related files.

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:



stixth7.bin File name: stixth7.bin
Size: 49.15 KB (49152 bytes)
MD5: ba7de7bb8972a269cff69eaa4de0309c
Detection count: 32
File type: Binary File
Mime Type: unknown/bin
Group: Malware file
Last Updated: June 21, 2012
file.exe File name: file.exe
Size: 93.18 KB (93184 bytes)
MD5: 92e843961e9f1714647d5d9985c010ac
Detection count: 31
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
Last Updated: June 21, 2012
file.exe File name: file.exe
Size: 82.94 KB (82944 bytes)
MD5: 72e8a4d4c8798ab5b0c7245d1fd6de26
Detection count: 30
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
Last Updated: June 21, 2012
file.exe File name: file.exe
Size: 134.28 KB (134287 bytes)
MD5: 0d64f67af08848c0cfe0993efe56beb9
Detection count: 11
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
Last Updated: June 21, 2012
%WINDIR%\iqs.exe File name: iqs.exe
Size: 152.06 KB (152064 bytes)
MD5: 6ad8969cf4fed4c7d47e92b5b7fcb1a4
Detection count: 5
File type: Executable File
Mime Type: unknown/exe
Path: %WINDIR%
Group: Malware file
Last Updated: June 21, 2012
%Windir%\MDM.EXE File name: %Windir%\MDM.EXE
File type: Executable File
Mime Type: unknown/EXE
Group: Malware file

Registry Modifications

The following newly produced Registry Values are:

HKEY..\..\{Value}HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\"%Windir%\mdm.exe" = "%Windir%\mdm.exe:*:Enabled:MSN Messenger"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\Microsoft\Windows\CurrentVersion\Run\"Microsoft Firevall Engine" = "%Windir%\MDM.EXE"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"Microsoft Firevall Engine" = "%Windir%\MDM.EXE"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\"Microsoft Firevall Engine" = "%Windir%\MDM.EXE"

Related Posts

Loading...