Audioman_exe New Malware !

Here is new malware that BitDefender cannot dectect to now. This malware attach another malware which be dectected with name : Generic.GrayBird to resource. So when malware is activated, it create services.exe in Windows\system, Explorer.sm1 in System32 and services.exe only run when computer is restarted. Then msinfo.exe is created in System32 dir, taskmgr.exe is created in Windows dir. They have name Generic.GrayBird but i don't understand why BitDefender cannot detect them when they are activated and request connect to internet

Here is sample. Pass : infected

/applications/core/interface/file/attachment.php?id=833" data-fileid="833" rel="">AudioMan_EXE.rar

Find more posts tagged with

Comments

Cd-MaN

Hello. The attached file will be detected as Backdoor.Hupigon.FBA and the dropped files are already detected as Generic.Graybird as you know (with the exception for Explorer.sm1, which seems to be log file of some sorts).

As for BD not being able to block it, I'm not exactly sure what you mean, since if the files are detected, the on-access scanner should block them on execution and prevent them from being active.

Best regards.

Crem

Hi Cd-MaN. Thanks for your update !

But i don't agree with you about file Explorer.sm1, it is not log file of some sorts. If you analysed carefully, you will see that : When sxs infect to computer, i will create :

HKEY_CLASSES_ROOT\.sm1

@ = "sm1_Auto_File"

HKEY_CLASSES_ROOT\sm1_Auto_File\shell\open\command

@ = "C:\WINDOWS\System\services.exe" "%1"

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run

AudioMan = "C:\WINDOWS\System32\Explorer.sm1"

Very ligthly, when Windows is loged on, file Explorer.sm1 will opened and execute file services.exe. So file Explorer.sm1 is file to start file malware.

I have small question, file msinfo.exe which file attached in file sxs.exe were detected by other verdor with naming convention is Backdoor.Hupigon.FBA while BitDefender detected it with name Generic.GrayBird. To now, file sxs.exe is also detected by Kaspersky with name Backdoor.Hupigon and BitDefender does as. Why is it ?

Best Regard

Crem !

Crem

Here is other variant of this malware family which BitDefender detected succesfully with name : Generic.GrayBird (on 25/9/2007)

Cd-MaN

Hupigon and Graybird are actually one and the same (or to be more precise: Graybird is a subset of the Hupigon family - at least in our naming convention, other vendors may differ), so the two names are used interchangeably.

Best regards.

Crem

Oki, Cd-MaN. But about file Explorer.sm1 . I think this file should be deleted.

Ah ! May you tell me about the way to put naming convention ! Why in other vendors but i see that many malware have same naming convention . What is it based on ?

Cd-MaN

The naming convention is more an ad-hoc thing in the sense that if during the signing process a file is not detected by other vendors, it will be named by the given researcher (unless it is part of a known family). If the sample is already detected by others and the detection name is considered appropriate, it will be used so that clients hopefully can identify the same detection across multiple vendors.

Crem

Thanks Cd-MaN for taking time to explain it to me

I really appreciate.

Crem