Cabrotor is backdoor, allowing an attacker to control the machine where it runs. The trojan itself is a Windows PE EXE file written in Delphi.
Once detected, the F-Secure security product will automatically disinfect the suspect file by either deleting it or renaming it.
The original trojan package contains three main executable files:
CaBrONaToR.exe - client to send commands to remote server CaBrONeDiT.exe - server editor to modify default server settings 8======D.exe - server (trojan itself)
When run, the backdoor code copies itself to the Windows directory and registers itself in the system registry in the auto-run section. In different backdoor versions the backdoor EXE name and registry keys are different. The known variant has:
The registry key entries it creates are located in:
And their names are:
The trojan then opens a connection to its master's IRC channel and waits for its master's commands.
The backdoor allows the attacker to invoke any of the following commands:
Reports computer information (Windows version, CPU type, UserName, CompanyName) Open/closes CD drive Reports directories and file names Runs a local file or command Send information: RAS, MS Messenger and .NET services Exits Windows Downloads a requested file Performs DoS attack to a requested victim address Terminates itself
Detection for Cabrotor worm is available in the following FSAV updates:
Detection Type: PC
Technical Details: Kaspersky Lab