BKDR_COZER.LP

This backdoor may arrive bundled with malware packages as a malware component. It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes commands from a remote malicious user, effectively compromising the affected system.

It gathers certain information on the affected computer.

Arrival Details

This backdoor may arrive bundled with malware packages as a malware component.

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Backdoor Routine

This backdoor executes the following commands from a remote malicious user:

• File Manipulation
• Execute/Terminate Process
• Download and execute files

It connects to the following URL(s) to send and receive commands from a remote malicious user:

• https://private.{BLOCKED}investing.com/lexicon/index.cfm?{parameters}
• https://www.{BLOCKED}arn.com/search.cfm?{parameters}
  where {parameters} are any of the following:
  
  • css={value}
  • dq={value}
  • ei={value}
  • f={value}
  • id={value}
  • lpg={value}
  • mode={value}
  • pg={value}
  • q={value}
  • rss={value}
  • sa={value}
  • source={value}
  • status={value}
  • utm_content={value}
  • utm_source={value}
  • utm_term={value}

Information Theft

This backdoor gathers the following information on the affected computer:

• User Name
• Computer Name
• OS Version
• Process List
• Processor Information