https://enciklopedija.cc/index.php?action=history&feed=atom&title=Infostealer.Banbot
Infostealer.Banbot - Povijest promjena
2026-09-01T08:25:18Z
Povijest promjena ove stranice na wikiju
MediaWiki 1.42.3
https://enciklopedija.cc/index.php?title=Infostealer.Banbot&diff=424038&oldid=prev
WikiSysop: brisanje nepotrebnog teksta
2022-03-08T10:42:45Z
<p>brisanje nepotrebnog teksta</p>
<table style="background-color: #fff; color: #202122;" data-mw="interface">
<col class="diff-marker" />
<col class="diff-content" />
<col class="diff-marker" />
<col class="diff-content" />
<tr class="diff-title" lang="hr">
<td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">←Starija inačica</td>
<td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">Inačica od 8. ožujak 2022. u 10:42</td>
</tr><tr><td colspan="2" class="diff-lineno" id="mw-diff-left-l1">Redak 1:</td>
<td colspan="2" class="diff-lineno">Redak 1:</td></tr>
<tr><td class="diff-marker" data-marker="−"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div><del style="font-weight: bold; text-decoration: none;"><!--'''Infostealer.Banbot'''--></del>'''Infostealer.Banbot''' (Troj/Small-EKE) je [[trojanski konj (softver)|trojanski konj]] otkriven [[13. rujna]] [[2007.]] godine. Zaražava računala koja rade pod operativnim sustavom [[Microsoft Windows]] ([[Windows 2000]], [[Windows 95]], [[Windows 98]], [[Windows Me]], [[Windows NT]], [[Windows Server 2003]], [[Windows Vista]], [[Windows XP]]).</div></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>'''Infostealer.Banbot''' (Troj/Small-EKE) je [[trojanski konj (softver)|trojanski konj]] otkriven [[13. rujna]] [[2007.]] godine. Zaražava računala koja rade pod operativnim sustavom [[Microsoft Windows]] ([[Windows 2000]], [[Windows 95]], [[Windows 98]], [[Windows Me]], [[Windows NT]], [[Windows Server 2003]], [[Windows Vista]], [[Windows XP]]).</div></td></tr>
<tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br></td></tr>
<tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>Infostealer.Banbot skida (''downloada'') datoteke s udaljenih lokacija te krade povjerljive podatke na zaraženom računalu. </div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>Infostealer.Banbot skida (''downloada'') datoteke s udaljenih lokacija te krade povjerljive podatke na zaraženom računalu. </div></td></tr>
</table>
WikiSysop
https://enciklopedija.cc/index.php?title=Infostealer.Banbot&diff=118430&oldid=prev
WikiSysop: Bot: Automatski unos stranica
2021-09-13T22:44:53Z
<p>Bot: Automatski unos stranica</p>
<p><b>Nova stranica</b></p><div><!--'''Infostealer.Banbot'''-->'''Infostealer.Banbot''' (Troj/Small-EKE) je [[trojanski konj (softver)|trojanski konj]] otkriven [[13. rujna]] [[2007.]] godine. Zaražava računala koja rade pod operativnim sustavom [[Microsoft Windows]] ([[Windows 2000]], [[Windows 95]], [[Windows 98]], [[Windows Me]], [[Windows NT]], [[Windows Server 2003]], [[Windows Vista]], [[Windows XP]]).<br />
<br />
Infostealer.Banbot skida (''downloada'') datoteke s udaljenih lokacija te krade povjerljive podatke na zaraženom računalu. <br />
<br />
== Opis ==<br />
Trojanski konj može doći kao privitak u [[spam]]u. E-mail privitak može sadržavati [[RTF]] ili [[DOC]] [[datoteka|datoteku]] u koju je ugrađena i druga datoteka koja na koju se mora dvaput kliknuti da bi se pokrenula. Ta ugrađena datoteka sadržava Infostealer.Banbot.<br />
<br />
Kada se ugrađena datoteka pokrene, ona kreira [[malware|maliciozne]] komponente C:\microsoft.dll i C:\microsoft.exe.<br />
<br />
Trojanski konj dodaje u ''[[Windows Registry]]'' vrijednosti <code>HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"Win32KerenlStart" = "C:\microsoft.exe"</code><code>HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\"Win32KerenlStart" = "C:\microsoft.exe"</code>,<code>HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices\"Win32KerenlStart" = "C:\microsoft.exe"</code>, <code>HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\"Win32KerenlStart" = "C:\microsoft.exe"</code>, <code>HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce\"Win32KerenlStart" = "C:\microsoft.exe"</code> i <code>HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServices\"Win32KerenlStart" = "C:\microsoft.exe"</code> kako bi se pokretao tijekom sljedećih podizanja sustava.<br />
<br />
Također napravi vrijednosti <code>HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8DB1B67A-E3CB-44A8-AFA6-ECE6D1E7D028}\"StubPath" = "C:\microsoft.exe"</code> i <code>HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Accessibility\Utility Manager\Magnifier\"Application path" = "C:\microsoft.exe"y</code>. <br />
<br />
Infostealer.Banbot blokira korisniku pristup ''Task Manageru'' mijenjajući registarsku vrijednost <code>HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\"DisableTaskMgr" = "1"</code>. Mijenja i vrijednoti <code>HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Accessibility\Utility Manager\Magnifier\"Start with Utility Manager" = "1"</code> i <code>HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Accessibility\Utility Manager\Magnifier\"Start with Windows" = "1</code><br />
<br />
Svoju komponentu microsoft.dll registrira kao Brower Helper Object kreiranjem registarskih podključeva <code>HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1E0ABEA7-7385-4B5E-A23A-6E97BD9F3412}</code> i <code>HKEY_CLASSES_ROOT\CLSID\{1E0ABEA7-7385-4B5E-A23A-6E97BD9F3412}</code><br />
<br />
Infostealer.Banbot pristupa stranici <nowiki>[http://]203.121.68.191/~ftwest/ftwestr[REMOVED]</nowiki> te s nje [[download|preuzima]] datoteku koju sprema kao C:\win32.exe. Nakon toga prati koje stranice korisnik obično posjećuje te potom te podatke stavlja u slučajno izabranu datoteku u %Temp% mapi (''folfer''). Kasnije informacije šalje u udaljeni [[poslužitelj]].<br />
<br />
== Izvor ==<br />
* [http://www.symantec.com/security_response/writeup.jsp?docid=2007-091318-2239-99&tabid=2 Symantec.com]<br />
<br />
[[Kategorija:Trojanci]]</div>
WikiSysop