BKDR_HORSMY.A

This backdoor is capable of sending system information to a remote server. If a connection to the server is established, it may download, upload or execute arbitrary files into the system.

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It does not have any propagation routine.

Arrival Details

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This backdoor adds the following mutexes to ensure that only one of its copies runs at any one time:

• myhorsemutex

It injects itself into the following processes as part of its memory residency routine:

• EXPLORER.EXE

Propagation

This backdoor does not have any propagation routine.

NOTES:

Backdoor Routine

It connects to the following server via HTTP POST / GET:

• www. {BLOCKED} bit.com

Initially, it sends the information contained in %System%\tmp.dat via HTTP POST, then awaits for commands from the remote computer. Once connection is established, it can do the following:

• Upload Files
• Download Files
• Execute file

Currently, the server is inaccessible.

Rootkit Capabilities

It does not have rootkit capabilities.

Other Details

It creates the following file that is also deleted after use:

• %System%\tmp.dat

(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.)

The said file is non-malicious and contains the following information:

• Host Name
• IP address
• List of processes
• OS language version
• OS version
• Path of System directory

This backdoor can use the following user agent when communicating with the server:

• mydownload
• MyAgent

It does not exploit any vulnerability.