Rbot.DEL is a Trojan. A Trojan is a program that pretends to have a valid use, but in fact modifies the user's computer in malicious way. Trojans do not replicate or spread to other computers. Rbot.DEL is compressed using the executable packer and its file size is 278,528 bytes. It uses the network connection: - Connects to "10.0.0.33" on port 135 (TCP).
- Connects to "10.0.0.34" on port 135 (TCP).
- Connects to "10.0.0.35" on port 135 (TCP).
- Connects to "10.0.0.36" on port 135 (TCP).
- Connects to "10.0.0.37" on port 135 (TCP).
- Connects to "10.0.0.38" on port 135 (TCP).
- Connects to "10.0.0.39" on port 135 (TCP).
- Connects to "10.0.0.40" on port 135 (TCP).
- Connects to "10.0.0.41" on port 135 (TCP).
- Connects to "10.0.0.42" on port 135 (TCP).
- Connects to "10.0.0.43" on port 135 (TCP).
- Connects to "10.0.0.44" on port 135 (TCP).
- Connects to "10.0.0.45" on port 135 (TCP).
- Connects to "10.0.0.46" on port 135 (TCP).
- Connects to "10.0.0.47" on port 135 (TCP).
- Connects to "10.0.0.48" on port 135 (TCP).
- Connects to "10.0.0.49" on port 135 (TCP).
Rbot.DEL drops the following files on the hard drive: - C:\WINDOWS\TEMP\ntsupdate.exe (278528 bytes)
- E:\miBicho.exe (278528 bytes)
- E:\autorun.inf (48 bytes)
It also changes Windows registry: - Creates value "Reealtek Semiconductor Corp."="ntsupdate.exe" in key "HKCU\Software\Microsoft\Windows\CurrentVersion\Run".
- Creates key "HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices".
- Creates value "Reealtek Semiconductor Corp."="ntsupdate.exe" in key "HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices".
- Creates key "HKCU\Software\Microsoft\OLE".
- Creates value "Reealtek Semiconductor Corp."="ntsupdate.exe" in key "HKCU\Software\Microsoft\OLE".
It creates the following mutex to ensure only one instance is running: Fr0zen. It also is executed every time Windows starts.
|
