Eng
  1. Skip to navigation
  2. Skip to content
  3. Skip to sidebar


Backdoor:W32/Binanen.A


Aliases:


Backdoor:W32/Binanen.A

Malware
Backdoor
W32

Summary

A dropper Trojan that contains malicious or potentially unwanted software, which it 'drops' and installs on the affected system.



Disinfection & Removal

Automatic Disinfection

Allow F-Secure Anti-Virus to disinfect the relevant files.

For more general information on disinfection, please see Removal Instructions.



Technical Details

Binanen.A creates a dummy iexplore.exe process, and runs its malicious activity by silently dropping the following file:

  • C:\windows\system32\winimet.dll

It also copies itself to:

  • C:\windows\system32\binanen.exe

And, creates the following registry keys:

  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{26D37492-FEC2-C272-9882-6D97A521F122}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{761CC820-6EC0-5921-1400-8442C1E2FB90}


Payload

Once the malware is executed, the dropped file will try to disguise itself under a true process name and will be injected into a hidden dummy process. Then, it will execute certain command lines such asipconfig, which can be used to retrieve IP address, subnet mask, and default gateway.

Once the DLL file has been injected and running under the hidden Internet Explorer process, the attacker will be able to control the infected machine and retrieve information such as list of processes and hard disk information from the affected machine. The attacker could also obtain data such as username, system date and time, and how long the machine has been up and running.







Submit a sample




Wondering if a file or URL is malicious? Submit a sample to our Lab for analysis via the Sample Analysis System (SAS)

Give And Get Advice




Give advice. Get advice. Share the knowledge on our free discussion forum.

Scan and clean your PC




F-Secure Online Scanner will scan and clean your PC in just a few minutes for free