Trojan:WinNT/Killav.B is a malicious driver, usually associated with banker trojans, that deletes antivirus components and banking tools from kernel mode.
Payload
When loaded, Trojan:WinNT/Killav.B deletes the following files, if found:
- Files associated with online banking applications:
\Device\HarddiskVolume1\Arquivos de programas\GbPlugin\gbpsv.exe
\Device\HarddiskVolume1\Arquivos de programas\GbPlugin\gbiehcef.dll
\Device\HarddiskVolume1\Arquivos de programas\GbPlugin\gbieh.gmd
\Device\HarddiskVolume1\Arquivos de programas\GbPlugin\cef.gpc
\Device\HarddiskVolume1\Arquivos de programas\GbPlugin\gbieh.dll
\Device\HarddiskVolume1\Arquivos de programas\GbPlugin\gbpdist.dll
\Device\HarddiskVolume1\Arquivos de programas\GbPlugin\bb.gpc
\Device\HarddiskVolume1\Arquivos de programas\GbPlugin\gbpkm.sys
\Device\HarddiskVolume1\Arquivos de programas\GbPlugin\gbpsv.exe
\Device\HarddiskVolume1\Arquivos de programas\Scpad\scpIBCfg.bin
\Device\HarddiskVolume1\Arquivos de programas\Scpad\scpMIB.dll
\Device\HarddiskVolume1\Arquivos de programas\Scpad\scpsssh2.dll
\Device\HarddiskVolume1\Arquivos de programas\Scpad\sshib.dll
\Device\HarddiskVolume1\WINDOWS\system32\scpsssh2.dll
\Device\HarddiskVolume1\WINDOWS\system32\drivers\gbpkm.sys
\Device\HarddiskVolume1\WINDOWS\Downloaded Program Files\scpsssh2.inf
\Device\HarddiskVolume1\WINDOWS\Downloaded Program Files\abn.gpc
\Device\HarddiskVolume1\WINDOWS\Downloaded Program Files\erma.inf
\Device\HarddiskVolume1\WINDOWS\Downloaded Program Files\gbieh.gmd
\Device\HarddiskVolume1\WINDOWS\Downloaded Program Files\gbiehabn.dll
\Device\HarddiskVolume1\WINDOWS\Downloaded Program Files\gbiehuni.dll
\Device\HarddiskVolume1\WINDOWS\Downloaded Program Files\GbPluginABN.inf
\Device\HarddiskVolume1\WINDOWS\Downloaded Program Files\GbPluginuni.inf
\Device\HarddiskVolume1\WINDOWS\Downloaded Program Files\uni.gpc
- Files associated with antivirus programs:
\Device\HarddiskVolume1\Arquivos de programas\Alwil Software\Avast4\ashLogV.exe
\Device\HarddiskVolume1\Arquivos de programas\Alwil Software\Avast4\VisthUpd.exe
\Device\HarddiskVolume1\Arquivos de programas\Alwil Software\Avast4\VisthUpd.exe
\Device\HarddiskVolume1\Arquivos de programas\Alwil Software\Avast4\ashWebSv.exe
\Device\HarddiskVolume1\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exe
\Device\HarddiskVolume1\Arquivos de programas\Alwil Software\Avast4\ashUpd.exe
\Device\HarddiskVolume1\Arquivos de programas\Avira\AntiVir Desktop\avscan.exe
\Device\HarddiskVolume1\Arquivos de programas\Avira\AntiVir Desktop\update.exe
\Device\HarddiskVolume1\Arquivos de programas\Avira\AntiVir Desktop\updfix.exe
\Device\HarddiskVolume1\Arquivos de programas\Avira\AntiVir Desktop\avupgsvc.exe
Analysis by Marian Radu