F-Secure Virus Descriptions : Cabrotor
[Summary] | [Detailed Description] | [Detection]
Cabrotor is backdoor, allowing an attacker to control the machine where it
runs. The trojan itself is a Windows PE EXE file written in Delphi.
The original trojan package contains three main executable files:
CaBrONaToR.exe - client to send commands to remote server
CaBrONeDiT.exe - server editor to modify default server settings
8======D.exe - server (trojan itself)
When run, the backdoor code copies itself to the Windows directory and
registers itself in the system registry in the auto-run section. In different
backdoor versions the backdoor EXE name and registry keys are different. The
known variant has:
Executable name:
ASDAPI.EXE
The registry key entries it creates are located in:
[HKLM\Software\Microsoft\Windows\CurrentVersion\Run]
[HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices]
And their names are:
LoadPowerProfile
The trojan then opens a connection to its master's IRC channel and waits for
its master's commands.
The backdoor allows the attacker to invoke any of the following commands:
Reports computer information (Windows version, CPU type, UserName, CompanyName)
Open/closes CD drive
Reports directories and file names
Runs a local file or command
Send information: RAS, MS Messenger and .NET services
Exits Windows
Downloads a requested file
Performs DoS attack to a requested victim address
Terminates itself
Detection for Cabrotor worm is available in the following FSAV
updates:
[FSAV_Database_Version]
Version=2002-07-22_01
Technical Details:
Kaspersky Lab
F-Secure Corporation
|