Threat Database Backdoors Backdoor.Prioxer.C

Backdoor.Prioxer.C

By GoldSparrow in Backdoors

Threat Scorecard

Ranking: 12,135
Threat Level: 10 % (Normal)
Infected Computers: 363
First Seen: October 8, 2013
Last Seen: August 28, 2023
OS(es) Affected: Windows

Backdoor.Prioxer.C is a backdoor Trojan that opens a back door on the targeted PC. Once Backdoor.Prioxer.C is run, it will check for a 32-bit environment to proceed, or it will stop. Backdoor.Prioxer.C may create registry entries on the affected computer. Backdoor.Prioxer.C may also delete registry entries. Backdoor.Prioxer.C may hijack one of the services detected in the certain registry subkey. Backdoor.Prioxer.C may delete the file recorded in the specific registry entity. Backdoor.Prioxer.C then deletes the registry entity. Backdoor.Prioxer.C opens a back door on the targeted PC and connects to the specific URLs. Backdoor.Prioxer.C may then accomplish the potentially damaging activities such as drop, run and manage files, grab system information, manage system processes and registry entries, shutdown the PC and clear events log.

Registry Details

Backdoor.Prioxer.C may create the following registry entry or registry entries:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\"ie" = "[RANDOM CHARACTERS]\[RANDOM CHARACTERS].exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\"it" = "[BINARY DATA]"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\[COMPROMISED SERVICE NAME]\"DependOnService" = ""
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\"id" = "[HEXIDECIMAL NUMBER]"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Btr\"Run" = "[BINARY DATA]"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\"ie"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\[COMPROMISED SERVICE NAME]\"Start" = "4"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\"svcname" = "[COMPROMISED SERVICE NAME]"

URLs

Backdoor.Prioxer.C may call the following URLs:

"jquery.js", "sviluppotjopes/testdianima.js"
[RANDOM CHARACTERS].1.hhzstsl.com

Trending

Most Viewed

Loading...