Win32/Spy.Bebloh [Threat Name] go to Threat

Win32/Spy.Bebloh.O [Threat Variant Name]

Category	trojan
Size	184352 B
Aliases	Trojan.Win32.Inject.acbmp (Kaspersky)
	Trojan.DownLoader23.15820 (Dr.Web)

The trojan serves as a backdoor. It can be controlled remotely.

When executed, the trojan copies itself in some of the the following locations:

The trojan may create the following files:

These are shortcuts to files of the trojan .

The trojan may set the following Registry entries:

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
- "%variable1%%variable2%%variable3%" = "%programfiles%\Windows NT\%variable1%%variable2%%variable3%.lnk"
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\
- "%variable1%%variable2%%variable3%" = "%appdata%\%variable1%%variable2%%variable3%.lnk"

This causes the trojan to be executed on every system start.

The %variable1% is one of the following strings:

A string with variable content is used instead of %variable2% .

The %variable3% is one of the following strings:

The trojan launches the following processes:

The trojan creates and runs a new thread with its own code within these running processes.

The trojan terminates its execution if it detects that it's running in a specific virtual environment.

Trojan quits immediately if it detects loaded module within its own process containing one of the following strings in its name:

The trojan quits immediately if it is run within a debugger.

The trojan quits immediately if the executable file path contains one of the following strings:

After the installation is complete, the trojan deletes the original executable file.

The trojan collects the following information:

The trojan attempts to send gathered information to a remote machine.

The trojan acquires data and commands from a remote computer or the Internet.

The trojan contains a URL address. The trojan generates various URL addresses. The HTTPS protocol is used in the communication.

It can execute the following operations:

The trojan keeps various information in the following Registry keys:

A string with variable content is used instead of %variable% .