Threat Description

Backdoor:​W32/Bredavi

Details

Aliases: Backdoor.Win32.Bredavi
Category: Malware
Type: Backdoor
Platform: W32

Summary



A remote administration utility that bypasses normal security mechanisms to secretly control a program, computer or network.



Removal



Automatic Disinfection

Allow F-Secure Anti-Virus to disinfect the relevant files.

For more general information on disinfection, please see Removal Instructions.



Technical Details



This is the Family Description for Backdoor:W32/Bredavi. Bredavi is a Remote Administration Tool (RAT) that can be exploited by remote users to gain control over a system on which the program is installed.

Installation process/actions

Upon its arrival in the system, the malware will check for its previous run on any of the targeted processes:

  • services.exe
  • iexplorer.exe
  • java.exe
  • javaw.exe
  • opera.exe

If the system is found clean with no traces that the malware has run on services.exe, the system will be infected then.

Using InterlockedExchange, the malware will hook the following functions:

  • From advapi32.dll - CryptEncrypt
  • From kernel32.dll - CreateFileW, GetFileAttributeExW
  • From ws2_32.dll - send, WSASend
  • From sks2xyz.dll (unknown dll that is believed to be its component) - vb_pfx_import
  • From User32.dll - GetWindowTextA

The malware will then look for iexplorer.exe, opera.exe, java.exe and javaw.exe, and injects itself in. It downloads a file from http://brendbar.cn/[...]n-bss.exe and saves it to '\\?\globalroot\systemroot\system32\ntfs_ext7.exe'.

It also makes a download from http://premiumbullets.cn/[...]php?id=!!. And, if "!killOS" string is found in the downloaded file, it terminates the following processes which are critical for the Windows operating system:

  • smss.exe
  • csrss.exe
  • lsass.exe
  • winlogon.exe

The malware modifies Windows host file to prevent the system from accessing domains that belongs to or affiliated with computer security companies.

Keylogger

The Bredavi malware contains a keylogger component, which surreptitiously monitors and stores all the strokes typed into the keyboard. For additional information on keylogger, please visit Terminology: Keylogger.






SUBMIT A SAMPLE

Suspect a file or URL was wrongly detected? Submit a sample to our Labs for analysis

Submit Now

Scan & clean your PC

F-Secure Online Scanner will scan and clean your PC in just a few minutes for free

Learn More