backdoor.haxdoor.
Webroot Antivirus: The best protection against viruses, spyware data theft and hackers.
Description:
Details
Backdoor.Haxdoor.o
This is a backdoor remote administration program. It spreads via the Internet using infected messages when commanded to by the author/user of the program. It is packed using FSG; the compressed file is 35792 bytes in size and the uncompressed file is 103936 bytes.
Installation
Once launched, the program installs itself in the Windows system directory as
w32_ss.exe
. It then installs the other program modules to the victim machine:
debugg.dll - main module
sdmapi.sys *
boot32.sys *
c3.dll *
c3.sys *
c4.sys *
Note: Files marked with an asterisk * will be installed only on systems running Windows NT/ 2000/ XP
The files are installed in the Windows system directory as follows:
System (Windows 9x)
System32 (Windows NT/2000/XP)
The program then registers itself in the system registry.
In systems running Windows 9x:
[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\MPRServices\TestService]
DllName="debugg.dll"
EntryPoint="MemManager"
StackSize=0
In systems running Windows NT/2000/XP:
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\debugg]
DllName="debugg.dll"
Startup="MemManager"
Impersonate=1
Asynchronous=1
MaxWait=1
Payload:
The program opens port 16661 and waits for client machines to connect. It has a wide range of remote administration commands, the main function being to intercept passwords on the victim machine and send them to the creator/ user of the program.
Mass mailing:
The program will mass mail messages if commanded to by the client machine. The contents of messages and attachment type are determined by the program's user and will vary widely.
Copyright @2006 backdoor.haxdoor.