XTOB

XTOB is a family of backdoors, which can communicate with command-and-control (C&C) servers to send and receive information and commands from malicious users.

Variants can perform notable commands such as SYN flood and DDOS attacks, and opening connection using Socks5 proxy.

They also gather system information such as affected computer’s user name, host name, OS version, and product ID. The file path and name of its dropped copy may vary depending on the affected machine’s OS version.

This backdoor executes commands from a remote malicious user, effectively compromising the affected system.

Installation

This backdoor drops the following copies of itself into the affected system:

• %System%\{random file name}.exe
• %Application Data%\Security Data\{random file name}.exe

(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.. %Application Data% is the Application Data folder, where it usually is C:\Documents and Settings\{user name}\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Roaming on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

It creates the following folders:

• %Application Data%\Security Data

(Note: %Application Data% is the Application Data folder, where it usually is C:\Documents and Settings\{user name}\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Roaming on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• system32

Other System Modifications

This backdoor adds the following registry entries:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
{random file name}.exe = "%System%\{random file name}.exe”

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
{random file name}.exe = "%Application Data%\Security Data\{random file name}.exe"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\AuthorizedApplications\
List
{random file name}.exe = "%System%\{random file name}.exe"

Backdoor Routine

This backdoor executes the following commands from a remote malicious user:

• Backdoor commands
• Perform SYN flood
• Perform DDOS
• Sleep
• Delete file
• Download and execute file
• Open a connection using Socks5 Proxy

Information Theft

This backdoor gathers the following data:

• User Name
• Host Name
• OS Version
• Product ID

Other Details

This backdoor connects to the following possibly malicious URL:

• http://{BLOCKED}d.to/reloadednet/ping.php
• http://{BLOCKED}d.to/reloadednet/sedo.php/id={Host Name}_{Product ID}&s5_uidx={digit}&os={OS Version}&s5=0&done
• http://{BLOCKED}e.kz/reloadednet/ping.php
• http://{BLOCKED}e.kz/reloadednet/sedo.php
• http://{BLOCKED}t.biz/sb/ping.php
• http://{BLOCKED}t.biz/sb/sedo.php
• http://{BLOCKED}supdate.{BLOCKED}lo.com/ping.php
• http://{BLOCKED}supdate.{BLOCKED}lo.com/sedo.php

NOTES:

The dropped copy's file path and name may depend on the affected machine's OS version.

The file name and registry value name {random file name} can be any of the following:

• Windows
• Components
• Audio
• Storage
• Profile
• Data
• Resources
• Deamonu
• Loader
• Guard
• WinProtect
• WinShield
• WinGuard

This malware queries the following registry entry to get the Product ID:

• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Product ID