BKDR_SERVSTAR.A

This backdoor opens port(s) where it listens for remote commands.

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes commands from a remote malicious user, effectively compromising the affected system.

It deletes itself after execution.

Arrival Details

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This backdoor drops the following copies of itself into the affected system:

• %System%\{random filename}.exe

(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.)

Autostart Technique

This backdoor registers itself as a system service to ensure its automatic execution at every system startup by adding the following registry entries:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\{Random Name}
ImagePath = "%System%\{Random name}.exe"

Backdoor Routine

This backdoor opens the following port(s) where it listens for remote commands:

• TCP 777

It executes the following commands from a remote malicious user:

• Download Files
• Remove Itself
• Send message to the affected system
• Get Operating System Information
• Execute Files
• Open a specific URL with Internet Explorer

It connects to the following URL(s) to send and receive commands from a remote malicious user:

• {BLOCKED}7.3322.org

Other Details

This backdoor deletes itself after execution.