BKDR_TRUEBOT.A

This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Autostart Technique

This Backdoor starts the following services:

• Default monitors

Backdoor Routine

This Backdoor connects to the following URL(s) to send and receive commands from a remote malicious user:

• {BLOCKED}.{BLOCKED}.184.29/index.php?xy={random}

It posts the following information to its command and control (C&C) server:

• Computer Name
• Log-on Server
• Processor Information
• Operating System
• Specific File Paths (i.e. Windows Directory, Program Data, Program Files)
• List of files with the following extensions:
  
  • .COM
  • .EXE
  • .BAT
  • .CMD.VBS
  • .VBE
  • .JS
  • .JSE
  • .WSF
  • .WSH
  • .MSC
  • .py
  • .pyw
• User Domain
• User Name
• Windows Tracing Log File