Threat Encyclopedia

This backdoor arrives as an attachment to email messages spammed by other malware/grayware or malicious users. It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. It may be dropped by other malware.

It executes commands from a remote malicious user, effectively compromising the affected system. However, as of this writing, the said sites are inaccessible.

Arrival Details

This backdoor arrives as an attachment to email messages spammed by other malware/grayware or malicious users.

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It may be dropped by the following malware:

• TROJ_ARTIEF.DOC

Installation

This backdoor drops the following non-malicious file:

• %System Root%\RECYCLER\aa.txt

(Note: %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.)

Autostart Technique

This backdoor drops the following shortcut pointing to its copy in the User Startup folder to enable its automatic execution at every system startup:

• MSN Talk Start.lnk

Backdoor Routine

This backdoor opens the following port(s) where it listens for remote commands:

• TCP Port 443

It executes the following commands from a remote malicious user:

• Act as a relay server
• Capture screen, audio, and webcam
• List active ports
• Log keystrokes
• Manage open Windows
• Manage passwords
• Manage registry, processes, services, devices, and installed applications
• Perform multiple simultaneous transfers
• Perform remote shell
• Search files
• Share servers
• Update, restart, terminate itself

It connects to the following URL(s) to send and receive commands from a remote malicious user:

• timesofindia.{BLOCKED}6.org
• timesofindia.{BLOCKED}p.net

However, as of this writing, the said sites are inaccessible.