Backdoor.Win32.Wootbot.gen

Summary

• Backdoor. Provides cybercriminals with remote access to an infected computer

• Trojan-Banker. Steals confidential information from banks, financial institutions and payment systems

• Performs potentially dangerous activity

Technical details

The main file is a Windows application (PE EXE file). File size of 137728 bytes. The file was packed using a special compression utility. Compression can be used for a number of reasons, including for legitimate programs. However, virus writers frequently use it to bypass antivirus protection and to make it difficult for virus analysts to analyze compressed programs Packed Morphine, UPX.

Installation

Copies itself once launched

Ensures Using the system registry, system services or special system files, the program can launch itself or launch the creation of its files every time the Windows OS is subsequently booted autorun of installed files:

by writing to autorun keys in the system registry

using system services

Malicious activity

Receives After a command from a cybercriminal, the program performs its malicious functions, for example, performing network attacks on internet sites, distributing spam and other malicious programs, or deleting a user's files. Those using this type of malicious program frequently make use of botnets (networks of infected computers which cybercriminals control centrally in order to carry out malicious activities.
Read more details here: http://www.viruslist.com/en/analysis?pubid=204792003remote commands from cybercriminal:

via connection to Receives commands from cybercriminals using IRC (Internet Relay Chat). After the malicious program is launched, it calls a specific IRC server and establishes contact with the cybercriminal, receives commands and passes on messages in responseIRC server

Steals confidential user information from A malicious program designed to steal user information related to banking and electronic payment systems and bank cards. The information is sent to a cybercriminal via email, ftp, the web or other methods.
Read more details here: http://www.viruslist.com/en/analysis?pubid=204792037the following banks, financial institutions, payment systems:

• PayPal

Other activities

Runs specific files (commands)

Deletes specific files onfrom the victim machine