BKDR_CABUTO.A

This backdoor may be dropped by other malware.

It executes commands from a remote malicious user, effectively compromising the affected system. It connects to a website to send and receive information.

It gathers certain information on the affected computer.

Arrival Details

This backdoor may be dropped by the following malware:

• TROJ_EXPLOYT.AGH

Installation

This backdoor drops the following files:

• %Application Data%\Micbt\IconConfigBt.DAT - Configuration File
• %User Temp%\win_32.sys - encryption table

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.. %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.)

It drops the following copies of itself into the affected system:

• %Application Data%\Micbt\wininit.exe

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.)

It creates the following folders:

• %Application Data%\Micbt

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.)

Autostart Technique

This backdoor drops the following file(s) in the Windows User Startup folder to enable its automatic execution at every system startup:

• %User Startup%\wininit.lnk

(Note: %User Startup% is the current user's Startup folder, which is usually C:\Windows\Profiles\{user name}\Start Menu\Programs\Startup on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Start Menu\Programs\Startup on Windows NT, and C:\Documents and Settings\{User name}\Start Menu\Programs\Startup.)

Other System Modifications

This backdoor adds the following registry keys:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\DbxUpdateBT

It adds the following registry entries:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\DbxUpdateBT
Mark = "{data from IconConfigBt.DAT}"

Backdoor Routine

This backdoor executes the following commands from a remote malicious user:

• File Manipulation
• Capture Screen
• Log Keyboard Strokes
• Download and Executre Arbitrary Files
• Retrieves Cookies
• Record Audio
• Remote Shell Command
• Process Manipulation

It connects to the following websites to send and receive information:

• {BLOCKED}4.{BLOCKED}s.net:80

Information Theft

This backdoor gathers the following information on the affected computer:

• OS Version
• Username
• Computer Name
• Memory Size (RAM)
• Network Username
• Hardware Information (Processor)
• Drive Information

Other Details

This backdoor checks for the presence of the following process(es):

• 360Tray.exe
• 360SD.exe