BKDR_TROGBOT.A

This backdoor may be dropped by other malware.

It opens a random port to allow a remote user to connect to the affected system. Once a successful connection is established, the remote user executes commands on the affected system.

Arrival Details

This backdoor may be dropped by the following malware:

• TROJ_PIDIEF.CSW
• TROJ_PIDIEF.CSX
• TROJ_PIDIEF.CRW

Installation

This backdoor drops the following component file(s):

• %System%\strunlib.dll - also detected as BKDR_TROGBOT.A

(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.)

Autostart Technique

This backdoor registers itself as a system service to ensure its automatic execution at every system startup by adding the following registry entries:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\MSStorage\Parameters
ServiceDll = strunlib.dll

Other System Modifications

This backdoor adds the following registry keys as part of its installation routine:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Storage\STConfig

Backdoor Routine

This backdoor opens the following port(s) where it listens for remote commands:

• Download Files
• Upload Files
• Manage Files
• Execute Files
• Check Drives
• Send Message
• Hibernate affected Machine

It opens a random port to allow a remote user to connect to the affected system. Once a successful connection is established, the remote user executes commands on the affected system.

It connects to the following URL(s) to send and receive commands from a remote malicious user:

• {BLOCKED}4.{BLOCKED}3.248.70
• {BLOCKED}9.{BLOCKED}2.148.82