Kolabc.BFK is a Trojan. A Trojan is a program that pretends to have a valid use, but in fact modifies the user's computer in malicious way. Trojans do not replicate or spread to other computers. Kolabc.BFK is compressed using the Armadillo executable packer and its file size is 802,816 bytes. Kolabc.BFK drops the following files on the hard drive: - C:\WINDOWS\system32\vgakpw.exe (802816 bytes)
It also changes Windows registry: - Creates key "HKLM\Software\Licenses".
- Sets value "{K7C0DB872A3F777C0}"="\xda\xaa\xc8\xb3\xf0\x11\x1er\x8e\x090N6\xf1\xdf<7\xe0\xb6\xe6A \x82\xff\xff\xff\xff\xff\xff\xff\xff\xcb\x87\xdfE\x870\x0c\xc3\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff" in key "HKLM\Software\Licenses".
- Creates key "HKCR\CLSID\{944EC1CC-740C-BC6F-353D-C50EB2F0D06E}".
- Sets value "{I4D34D9C7B20EC34A}"="\x01" in key "HKLM\Software\Licenses".
It creates the following mutex to ensure only one instance is running: RALDDA47A9F. DDA47A9F::WK. v1. It also contains anti-debugging code, is executed every time Windows starts.
|
