BackDoor-DKI.gen.ak Description

BackDoor-DKI.gen.ak is a malicious backdoor Trojan. BackDoor-DKI.gen.ak is able to run in the background of a system and give remote attackers access to the compromised PC. BackDoor-DKI.gen.ak can spread by exploiting local network shares. Once executed, BackDoor-DKI.gen.ak will join a predefined IRC server and channel in order to participate in DDoS attacks.

Type: Backdoors

How Can You Detect BackDoor-DKI.gen.ak?

BackDoor-DKI.gen.ak Technical Report

As new BackDoor-DKI.gen.ak details are reported by our customers and findings from our Threat Research Center, we will update this section.

BackDoor-DKI.gen.ak’s Country of Origin:

• Sweden

BackDoor-DKI.gen.ak Removal Details

BackDoor-DKI.gen.ak has typically the following processes in memory:

• %AppData%\Xenocode\Sandbox\1.0.0.0\1430.12.21T22.24\Virtual\STUBEXE\@SYSTEM@\server.exe

BackDoor-DKI.gen.ak creates the following files in the system:

• %AppData%\Xenocode\Sandbox\1.0.0.0\1430.12.21T22.24\Virtual\XRegistry.bin
• %System%\cam\klog.dat

BackDoor-DKI.gen.ak creates the following registry entries:

• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9B71D88C-C598-4935-C5D1-43AA4DB90836}]
• [HKEY_LOCAL_MACHINE\SOFTWARE\Bifrost]
• [HKEY_CURRENT_USER\Software\Bifrost]

Important Article Disclaimer