Win32/Bewymids [Threat Name] go to Threat
Win32/Bewymids.D [Threat Variant Name]
| Category | trojan |
| Size | 81920 B |
| Aliases | Trojan:Win32/Bewymids!rfn (Microsoft) |
| Infostealer.Hoardy (Symantec) | |
| DLOADER.Trojan (Dr.Web) |
Short description
The trojan serves as a backdoor. It can be controlled remotely.
Installation
The trojan does not create any copies of itself.
The trojan is probably a part of other malware.
The trojan may set the following Registry entries:
- [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\PhishingFilter]
- "Enabled" = 1
- "ShownVerifyBalloon" = 3
- [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
- "Check_Associations" = "no"
- "Start Page" = "about:blank"
- "DisableFirstRunCustomize" = 2
- [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
- "IEHardenIENoWarn" = 0
- [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
- "IEharden" = 0
- [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Recovery]
- "AutoRecover" = 2
- [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
- "DEPOff" = 1
- [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones]
- "2500" = 3
- [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
- "WarnonZoneCrossing" = 0
- "WarnOnPostRedirect" = 0
- [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
- "ProxyEnable" = 1
- "ProxyServer" = "%variable1%"
- "AutoConfigURL" = "%variable2%"
The trojan may create the following files:
- %appdata%\Microsoft\windows\CManger\wuacult.txt
- %appdata%\Microsoft\windows\CManger\%variable3%
A string with variable content is used instead of %variable1-3% .
Information stealing
The trojan collects the following information:
- computer name
- information about the operating system and system settings
- volume serial number
The trojan attempts to send gathered information to a remote machine.
Other information
The trojan acquires data and commands from a remote computer or the Internet.
The trojan contains a list of (16) URLs. The HTTP protocol is used in the communication.
It may perform the following actions:
- download files from a remote computer and/or the Internet
- run executable files
- upload files to a remote computer
- send gathered information
The trojan executes the following files:
- %appdata%\Microsoft\windows\CManger\smc.exe