Home / malware

PDF

Backdoor:Win32/Xies.A

First posted on 29 December 2014.
Source: Microsoft

Aliases :

There are no other names known for Backdoor:Win32/Xies.A.

Explanation :

Threat behavior

Installation


The malware uses code injection to make it harder to detect and remove. It can inject code into running processes, including:

• \msiexec.exe

Payload


Allows backdoor access and control

This threat can give a malicious hacker access and control of your PC. They can then perform a number of different actions, including:

• Deleting files
• Downloading and running files
• Logging your keystrokes or stealing your sensitive data
• Modifying your system settings
• Running or stopping applications
• Spreading malware to other PCs
• Uploading files

Additional information

Creates a mutex

This threat can create one or more mutexes on your PC. For example:

• __PDH_PLA_MUTEX__
• ASP.NET_Perf_Library_Lock_PID_904
• MSDTC_Perf_Library_Lock_PID_904
• PerfNet_Perf_Library_Lock_PID_904
• PerfOS_Perf_Library_Lock_PID_904
• PSched_Perf_Library_Lock_PID_904
• RSVP_Perf_Library_Lock_PID_904
• Spooler_Perf_Library_Lock_PID_904
• TapiSrv_Perf_Library_Lock_PID_904
• Tcpip_Perf_Library_Lock_PID_904

It might use this mutex as an infection marker to prevent more than one copy of the threat running on your PC.

This malware description was published using automated analysis of file SHA1 b0c793a1da115c6f1b51a2f3a9ffe1e17238487c. Symptoms

The following can indicate that you have this threat on your PC:

• You see a mutex such as:
  • __PDH_PLA_MUTEX__
  • ASP.NET_Perf_Library_Lock_PID_904
  • MSDTC_Perf_Library_Lock_PID_904
  • PerfNet_Perf_Library_Lock_PID_904
  • PerfOS_Perf_Library_Lock_PID_904
  • PSched_Perf_Library_Lock_PID_904
  • RSVP_Perf_Library_Lock_PID_904
  • Spooler_Perf_Library_Lock_PID_904
  • TapiSrv_Perf_Library_Lock_PID_904
  • Tcpip_Perf_Library_Lock_PID_904

Last update 29 December 2014

 

TOP