XTOB
Windows 2000, Windows Server 2003, Windows XP (32-bit, 64-bit), Windows Vista (32-bit, 64-bit), Windows 7 (32-bit, 64-bit)
![](/vinfo/imgFiles/legend.jpg)
Threat Type: Backdoor
Destructiveness: No
Encrypted:
In the wild: Yes
OVERVIEW
XTOB is a family of backdoors, which can communicate with command-and-control (C&C) servers to send and receive information and commands from malicious users.
Variants can perform notable commands such as SYN flood and DDOS attacks, and opening connection using Socks5 proxy.
They also gather system information such as affected computer’s user name, host name, OS version, and product ID. The file path and name of its dropped copy may vary depending on the affected machine’s OS version.
This backdoor executes commands from a remote malicious user, effectively compromising the affected system.
TECHNICAL DETAILS
Installation
This backdoor drops the following copies of itself into the affected system:
- %System%\{random file name}.exe
- %Application Data%\Security Data\{random file name}.exe
(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.. %Application Data% is the Application Data folder, where it usually is C:\Documents and Settings\{user name}\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Roaming on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)
It creates the following folders:
- %Application Data%\Security Data
(Note: %Application Data% is the Application Data folder, where it usually is C:\Documents and Settings\{user name}\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Roaming on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)
It adds the following mutexes to ensure that only one of its copies runs at any one time:
- system32
Other System Modifications
This backdoor adds the following registry entries:
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
{random file name}.exe = "%System%\{random file name}.exe”
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
{random file name}.exe = "%Application Data%\Security Data\{random file name}.exe"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\AuthorizedApplications\
List
{random file name}.exe = "%System%\{random file name}.exe"
Backdoor Routine
This backdoor executes the following commands from a remote malicious user:
- Backdoor commands
- Perform SYN flood
- Perform DDOS
- Sleep
- Delete file
- Download and execute file
- Open a connection using Socks5 Proxy
Information Theft
This backdoor gathers the following data:
- User Name
- Host Name
- OS Version
- Product ID
Other Details
This backdoor connects to the following possibly malicious URL:
- http://{BLOCKED}d.to/reloadednet/ping.php
- http://{BLOCKED}d.to/reloadednet/sedo.php/id={Host Name}_{Product ID}&s5_uidx={digit}&os={OS Version}&s5=0&done
- http://{BLOCKED}e.kz/reloadednet/ping.php
- http://{BLOCKED}e.kz/reloadednet/sedo.php
- http://{BLOCKED}t.biz/sb/ping.php
- http://{BLOCKED}t.biz/sb/sedo.php
- http://{BLOCKED}supdate.{BLOCKED}lo.com/ping.php
- http://{BLOCKED}supdate.{BLOCKED}lo.com/sedo.php
NOTES:
The dropped copy's file path and name may depend on the affected machine's OS version.
The file name and registry value name {random file name} can be any of the following:
- Windows
- Components
- Audio
- Storage
- Profile
- Data
- Resources
- Deamonu
- Loader
- Guard
- WinProtect
- WinShield
- WinGuard
This malware queries the following registry entry to get the Product ID:
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Product ID