BKDR_WATERTIGERENC-G.ZKGL-A

This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It does not have any propagation routine.

It executes commands from a remote malicious user, effectively compromising the affected system.

It executes the downloaded files. As a result, malicious routines of the downloaded files are exhibited on the affected system.

It does not have any information-stealing capability.

It requires its main component to successfully perform its intended routine.

Arrival Details

This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Propagation

This Backdoor does not have any propagation routine.

Backdoor Routine

This Backdoor executes the following commands from a remote malicious user:

• Arbitrary Code

It connects to the following URL(s) to send and receive commands from a remote malicious user:

• zmusic.lo{BLOCKED}.com:443

As of this writing, the said sites are inaccessible.

Rootkit Capabilities

This Backdoor does not have rootkit capabilities.

Download Routine

This Backdoor connects to the following URL(s) to download its component file(s):

• zmusic.lo{BLOCKED}.com:443

It then executes the downloaded files. As a result, malicious routines of the downloaded files are exhibited on the affected system.

Information Theft

This Backdoor does not have any information-stealing capability.

Other Details

This Backdoor requires its main component to successfully perform its intended routine.

It does not exploit any vulnerability.