Threat Database Backdoors Backdoor.Matsnu.B

Backdoor.Matsnu.B

By JubileeX in Backdoors

Backdoor.Matsnu.B is a backdoor Trojan that opens a back door on the attacked PC. Once run, Backdoor.Matsnu.B creates copies of itself as one of the harmful files.Backdoor.Matsnu.B creates the registry entries so that it can load automatically whenever the computer owner starts Windows. Backdoor.Matsnu.B connects to one of the domains and waits for instructions from the remote cybercriminal. Backdoor.Matsnu.B
downloads and runs files, updates the list of domains, updates itself, deletes all files and folders in any hard drives found and overwrites the first 10,000 bytes in fixed hard drives and deletes the specific files.

File System Details

Backdoor.Matsnu.B may create the following file(s):
# File Name Detections
1. %Temp%\[RANDOM FILE NAME].exe
2. %UserProfile%\[RANDOM FILE NAME].exe
3. %UserProfile%\Application Data\[RANDOM FILE NAME].exe
4. %DriveLetter%\ntdetect.com
5. %DriveLetter%\ntldr

Registry Details

Backdoor.Matsnu.B may create the following registry entry or registry entries:
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows\"load" = "[PATH TO TROJAN]"
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows\"run" = "[PATH TO TROJAN]"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\"Startup" = "[PATH TO TROJAN FOLDER]"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\"[COMPUTER SPECIFIC STRING]" = "[PATH TO TROJAN]"

Trending

Most Viewed

Loading...