Threat Description



Aliases: Backdoor.Win32.Bredavi
Category: Malware
Type: Backdoor
Platform: W32


A remote administration utility that bypasses normal security mechanisms to secretly control a program, computer or network.


Automatic action

Once detected, the F-Secure security product will automatically disinfect the suspect file by either deleting it or renaming it.


Detailed instructions for F-Secure security products are available in the documentation found in the Downloads section of our Home - Global site.

You may also refer to the Knowledge Base on the F-Secure Community site for further assistance.

Technical Details

This is the Family Description for Backdoor:W32/Bredavi. Bredavi is a Remote Administration Tool (RAT) that can be exploited by remote users to gain control over a system on which the program is installed.

Installation process/actions

Upon its arrival in the system, the malware will check for its previous run on any of the targeted processes:

  • services.exe
  • iexplorer.exe
  • java.exe
  • javaw.exe
  • opera.exe

If the system is found clean with no traces that the malware has run on services.exe, the system will be infected then.

Using InterlockedExchange, the malware will hook the following functions:

  • From advapi32.dll - CryptEncrypt
  • From kernel32.dll - CreateFileW, GetFileAttributeExW
  • From ws2_32.dll - send, WSASend
  • From sks2xyz.dll (unknown dll that is believed to be its component) - vb_pfx_import
  • From User32.dll - GetWindowTextA

The malware will then look for iexplorer.exe, opera.exe, java.exe and javaw.exe, and injects itself in. It downloads a file from[...]n-bss.exe and saves it to '\\?\globalroot\systemroot\system32\ntfs_ext7.exe'.

It also makes a download from[...]php?id=!!. And, if "!killOS" string is found in the downloaded file, it terminates the following processes which are critical for the Windows operating system:

  • smss.exe
  • csrss.exe
  • lsass.exe
  • winlogon.exe

The malware modifies Windows host file to prevent the system from accessing domains that belongs to or affiliated with computer security companies.


The Bredavi malware contains a keylogger component, which surreptitiously monitors and stores all the strokes typed into the keyboard. For additional information on keylogger, please visit Encyclopedia: Keylogger.


Suspect a file or URL was wrongly detected? Submit a sample to our Labs for analysis

Submit Now

Give And Get Advice

Give advice. Get advice. Share the knowledge on our free discussion forum.

Learn More