Eng
  1. Skip to navigation
  2. Skip to content
  3. Skip to sidebar


Cabrotor


Aliases:


Cabrotor
Backdoor.Cabrotor.10.a, Cabronator

Malware

W32

Summary

Cabrotor is backdoor, allowing an attacker to control the machine where it runs. The trojan itself is a Windows PE EXE file written in Delphi.



Disinfection & Removal

Automatic Disinfection

Allow F-Secure Anti-Virus to disinfect the relevant files.

For more general information on disinfection, please see Removal Instructions.



Technical Details

The original trojan package contains three main executable files:

CaBrONaToR.exe - client to send commands to remote server
 CaBrONeDiT.exe - server editor to modify default server settings
 8======D.exe - server (trojan itself)
 

When run, the backdoor code copies itself to the Windows directory and registers itself in the system registry in the auto-run section. In different backdoor versions the backdoor EXE name and registry keys are different. The known variant has:

Executable name:

ASDAPI.EXE


The registry key entries it creates are located in:

[HKLM\Software\Microsoft\Windows\CurrentVersion\Run]
 [HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices]
 

And their names are:

LoadPowerProfile


The trojan then opens a connection to its master's IRC channel and waits for its master's commands.

The backdoor allows the attacker to invoke any of the following commands:

Reports computer information (Windows version, CPU type, UserName, CompanyName)
 Open/closes CD drive
 Reports directories and file names
 Runs a local file or command
 Send information: RAS, MS Messenger and .NET services
 Exits Windows
 Downloads a requested file
 Performs DoS attack to a requested victim address
 Terminates itself
 


Detection

Detection for Cabrotor worm is available in the following FSAV updates:

Detection Type: PC
Database: 2002-07-22_01



Technical Details: Kaspersky Lab



Submit a sample




Wondering if a file or URL is malicious? Submit a sample to our Lab for analysis via the Sample Analysis System (SAS)

Give And Get Advice




Give advice. Get advice. Share the knowledge on our free discussion forum.