Backdoor.Win32.TRAMSCAT.A

This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It does not have any propagation routine.

It executes commands from a remote malicious user, effectively compromising the affected system.

It gathers certain information on the affected computer.

However, as of this writing, the said sites are inaccessible.

Arrival Details

This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Backdoor adds the following processes:

• %System%\schtasks.exe

(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.)

It injects codes into the following process(es):

• schtask.exe

Propagation

This Backdoor does not have any propagation routine.

Backdoor Routine

This Backdoor executes the following commands from a remote malicious user:

• Connect and disconnect to a named pipe
• Upload/download files
• Execute files
• Manage files (List, Create, Delete, Modify, Move, Copy)
• Manage processes (Create, Terminate)
• Gather credentials using CredEnumerate or PStoreCreateInstance

It connects to the following URL(s) to send and receive commands from a remote malicious user:

• https://smartcat.{BLOCKED}s.org/showthread.php?t={Random}

Rootkit Capabilities

This Backdoor does not have rootkit capabilities.

Information Theft

This Backdoor gathers the following information on the affected computer:

• Host name
• IPv4 address of the machine
• Internet Explorer Version
• Current user's Internet Explorer proxy configuration

It accepts the following parameters:

• "smartcat.{BLOCKED}s.org:443 {BLOCKED}.{BLOCKED}.44.2:8080"

Other Details

This Backdoor does the following:

• It must be executed with a specific parameter in order to continue to it's malicious routine.
• It adds and injects code to a newly created process.
• It sends the following information to its C&C server:
  • IPv4 Address of the machine
  • Machine's HostName

However, as of this writing, the said sites are inaccessible.

It does not exploit any vulnerability.