Backdoor.Win32.Haxdoor.o

Technical Details

This is a backdoor remote administration program. It spreads via the Internet using infected messages when commanded to by the author/user of the program. It is packed using FSG; the compressed file is 35792 bytes in size and the uncompressed file is 103936 bytes.

Installation

Once launched, the program installs itself in the Windows system directory as

  w32_ss.exe

. It then installs the other program modules to the victim machine:

  debugg.dll - main module
  sdmapi.sys *
  boot32.sys *
  c3.dll *
  c3.sys *
  c4.sys *

Note: Files marked with an asterisk * will be installed only on systems running Windows NT/ 2000/ XP

The files are installed in the Windows system directory as follows:

  System (Windows 9x)
  System32 (Windows NT/2000/XP)

The program then registers itself in the system registry.

In systems running Windows 9x:

   [HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\MPRServices\TestService]
   DllName="debugg.dll"
   EntryPoint="MemManager"
   StackSize=0

In systems running Windows NT/2000/XP:

   [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\debugg]
   DllName="debugg.dll"
   Startup="MemManager"
   Impersonate=1
   Asynchronous=1
   MaxWait=1

Payload:

The program opens port 16661 and waits for client machines to connect. It has a wide range of remote administration commands, the main function being to intercept passwords on the victim machine and send them to the creator/ user of the program.

Mass mailing:

The program will mass mail messages if commanded to by the client machine. The contents of messages and attachment type are determined by the program's user and will vary widely.