Backdoor.Win32.Delf.akw

Technical Details

This Trojan program provides a remote malicious user with access to the victim machine. It is a Windows PE EXE file. It is 245 760 bytes in size. It is written in Delphi.

Installation

When launched, the Trojan drops a file called "service.exe" (182 941 bytes in size) to the Windows system directory. It then launches this file for execution with the following paramters:

The backdoor adds a service called "r_server" to the system registry:

[HKLM\Software\CurrentControlSet\Services\r_server] "Start" = "dword:0x00000002" "ImagePath" = "%System%\service.exe /service" "DisplayName" = "Remote Administrator Service"

The service will automatically be launched next time the system is booted.

Payload

Once installed, the Trojan will be launched and listen on a designated port with the following password:

The backdoor provides access to the victim machine via Telnet. The backdoor provides access to the user's files and the ability to remotely manage the system.

Removal instructions

If your computer does not have an up-to-date antivirus, or does not have an antivirus solution at all, follow the instructions below to delete the malicious program:

1. Use Task Manager to terminate the "service.exe" process.
2. Delete the following file:
   %System%\service.exe
3. Delete the following parameters from the system registry (see What is a system registry and how do I use it for details on how to edit the registry).
   [HKLM\Software\CurrentControlSet\Services\r_server]
4. Update your antivirus databases and perform a full scan of the computer (download a trial version of Kaspersky Anti-Virus).

Summary

• Trojan-Dropper. Hidden installation of other malicious programs in the system

• Implements network activity

Technical details

File size of 245760 bytes. The file was packed using a special compression utility. Compression can be used for a number of reasons, including for legitimate programs. However, virus writers frequently use it to bypass antivirus protection and to make it difficult for virus analysts to analyze compressed programs Packed Morphine, UPX.

Installation

Creates the following files on an infected computer:

• Windows system directory (usually, C:\Windows\System32) %System%\AdmDll.dll (­Kaspersky Anti-Virus detects as­ Backdoor.Win32.RAdmin.j)

Malicious activity

Creates the following files:

• Windows system directory (usually, C:\Windows\System32) %System%\service.exe (­Kaspersky Anti-Virus detects as­ not-a-virus:RemoteAdmin.Win32.RAdmin.21)

Ensures subsequent Using the system registry, system services or special system files, the program can launch itself or launch the creation of its files every time the Windows OS is subsequently booted autorun of installed files:

using system services:

Service name:	r_server
Displayed service name:	Remote Administrator Service
Startup parameters	Windows system directory (usually, C:\Windows\System32) %System%\service.exe /service
Startup type:	­automatic­

Launches files shown below for execution:

• Windows system directory (usually, C:\Windows\System32) %System%\service.exe /install /silence
• Windows system directory (usually, C:\Windows\System32) %System%\service.exe (­implements multiple launch­)
• Windows system directory (usually, C:\Windows\System32) %System%\service.exe /pass:SXX13CVV2 /port:4899 /save /silence

Opens the following ports on an infected computer for incoming connections:

• 8979