Classification

Category :

Malware

Type :

-

Aliases :

Cabrotor, Backdoor.Cabrotor.10.a, Cabronator

Summary

Cabrotor is backdoor, allowing an attacker to control the machine where it runs. The trojan itself is a Windows PE EXE file written in Delphi.

Removal

Based on the settings of your F-Secure security product, it will either move the file to the quarantine where it cannot spread or cause harm, or remove it.

A False Positive is when a file is incorrectly detected as harmful, usually because its code or behavior resembles known harmful programs. A False Positive will usually be fixed in a subsequent database update without any action needed on your part. If you wish, you may also:

  • Check for the latest database updates

    First check if your F-Secure security program is using the latest updates, then try scanning the file again.

  • Submit a sample

    After checking, if you still believe the file is incorrectly detected, you can submit a sample of it for re-analysis.

    Note: If the file was moved to quarantine, you need to collect the file from quarantine before you can submit it.

  • Exclude a file from further scanning

    If you are certain that the file is safe and want to continue using it, you can exclude it from further scanning by the F-Secure security product.

    Note: You need administrative rights to change the settings.

Technical Details

The original trojan package contains three main executable files:

CaBrONaToR.exe - client to send commands to remote server
CaBrONeDiT.exe - server editor to modify default server settings
8======D.exe - server (trojan itself)
 

When run, the backdoor code copies itself to the Windows directory and registers itself in the system registry in the auto-run section. In different backdoor versions the backdoor EXE name and registry keys are different. The known variant has:

Executable name:

ASDAPI.EXE
 

The registry key entries it creates are located in:

[HKLM\Software\Microsoft\Windows\CurrentVersion\Run]
[HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices]
 

And their names are:

LoadPowerProfile
 

The trojan then opens a connection to its master's IRC channel and waits for its master's commands.

The backdoor allows the attacker to invoke any of the following commands:

Reports computer information (Windows version, CPU type, UserName, CompanyName)
Open/closes CD drive
Reports directories and file names
Runs a local file or command
Send information: RAS, MS Messenger and .NET services
Exits Windows
Downloads a requested file
Performs DoS attack to a requested victim address
Terminates itself