Win32/Delf.NXE [Threat Name] go to Threat
Win32/Delf.NXE [Threat Variant Name]
| Category | trojan |
| Size | 609792 B |
| Aliases | Backdoor.Win32.Delf.uay (Kaspersky) |
| PWS:Win32/Mmosteal (Microsoft) |
Short description
The trojan serves as a backdoor. It can be controlled remotely. The file is run-time compressed using Obsidium .
Installation
The trojan does not create any copies of itself.
In order to be executed on every system start, the trojan sets the following Registry entries:
- [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
- "windows" = "%malwarepath%"
- [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
- "Userinit" = "%originalvalue%, %malwarepath%"
Other information
The trojan acquires data and commands from a remote computer or the Internet.
The trojan contains a list of (1) URLs.
The HTTP protocol is used.
It can execute the following operations:
- download files from a remote computer and/or the Internet
- send files to a remote computer
- steal information from the Windows clipboard
- various filesystem operations
- run executable files
- terminate running processes
- update itself to a newer version
- perform DoS/DDoS attacks
- shut down/restart the computer
- capture screenshots
- log keystrokes
- show/hide application windows