Downloader Win32.Delf.dqu (irat.rmvb,mm.exe) Analysis of killing _ virus

File name: Irat.rmvb\mm.exe

File size: 140800 byte

AV name:

Downloader.Win32.Delf.dqu (Kaspersky)
MULTIDROPPER-JD (McAfee)
Downloader/w32. AGENT.137216.I (Nprotect)

Shell way: not

Written Language: Delphi

File md5:1b2cf1cdcb03c7c990c6ffe5a75e0f9b

Virus type: Back door

Behavioral Analysis:

1. Release virus copy:

C:\WINDOWS\SYSTEM32\IRAT.RMVB 130194 bytes

2, registration for system services, boot by Svchost.exe start:

Hkey_local_machine\system\currentcontrolset\services\irat
Category name: {No category}
Value of 0
Name: Type
Type: REG_DWORD
Data: 0x110

Value of 1
Name: Start
Type: REG_DWORD
Data: 0x2

Value of 2
Name: ErrorControl
Type: REG_DWORD
Data: 0x0

Value of 3
Name: ImagePath
Type: REG_EXPAND_SZ
Data:%systemroot%\system32\svchost.exe-k AUDIOSRVC

Value of 4
Name: DisplayName
Type: REG_SZ
Data: Irat

Value of 5
Name: objectname
Type: REG_SZ
Data: LocalSystem

Value of 6
Name: Description
Type: REG_SZ
Data: System processes



3, finish the above work, then release a delex.bat, delete itself.


4, the use of svchost process reverse connection outside, accept remote control.


5, every once in a while to detect the existence of their own registry keys and files, if not in the regeneration.

Workaround:

1, download Sreng (can download to down.45it.com), and then restart the computer, press F8 into Safe mode.

2. Delete this service item with Sreng:

[Irat/irat] [Running/disabled]
{C:\windows\System32\svchost.exe-k audiosrvc--} c:\windows\system32\irat.rmvb}{}

3, delete hard disk files:

C:\windows\system32\IRAT.rmvb