HTML_ASPDOOR.M

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. It may be dropped by other malware.

It executes commands from a remote malicious user, effectively compromising the affected system.

Arrival Details

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It may be dropped by other malware.

Backdoor Routine

This backdoor executes the following commands from a remote malicious user:

• Enumerate/list directories
• Query system information
• Perform network operations (HTTP finger, POP3, FTP)
• Query server local groups and users
• Query network information (IDs, IP addresses, server name)
• Scan for port information
• Brute force POP3 and FTP connections
• Execute shell command
• List, start, and kill processes
• Query process information
• List, start, and kill services
• Query service information
• List application event logs
• List system event logs
• Perform database operations (SQL)
• Perform file operations
• Upload/download files

Download Routine

This backdoor accesses the following websites to download files:

• http://swamp.{BLOCKED}s.net/fizzgig/fgdump/fgdump-2.1.0.zip (downloads a password dumping utility)

Other Details

This backdoor connects to the following URL(s) to get the affected system's IP address:

• http://www.my-ip-neighbors.com
• http://www.onthesamehost.com