Home / malware

PDF

Backdoor:Win32/Cycbot.I

First posted on 07 May 2019.
Source: Microsoft

Aliases :

Backdoor:Win32/Cycbot.I is also known as BKDR_CYCBOT.SME3, Troj/CycBot-R.

Explanation :

Backdoor:Win32/Cycbot.I is a backdoor trojan that allows attackers unauthorized access and control of an affected computer. After a computer is infected, the trojan connects to a specific IRC server and joins a specific channel to receive commands from attackers. Commands can instruct the trojan to spread to other computers by scanning for network shares with weak passwords, exploiting Windows vulnerabilities, or possibly spreading through backdoor ports opened by other families of malicious software. The trojan may also allow attackers to perform other backdoor functions, such as launching denial of service (DoS) attacks and retrieving system information from infected computers. Installation When executed, Backdoor:Win32/Cycbot.I copies itself to %programfiles%lp0ca7f.exe.
The malware modifies the following registry entries to ensure that its copy executes at each Windows start:

Adds value: "B7F.exe"
With data: "c:program fileslp0ca7f.exe"
To subkey: HKLMSOFTWAREMicrosoftWindowsCurrentVersionRun
The malware creates the following files on an affected computer:
%programfiles%lp0ca7.tmp - detected as PWS:Win32/Fareit.gen!C %programfiles%lp0ca8.exe %programfiles%lp0ca9.exe c:documents and settingsadministratorapplication dataacc0ee9de.cc0 c:documents and settingsadministratorapplication datamicrosoftcryptneturlcachecontent7b2238aaccedc3f1ffe8e7eb5f575ec9 c:documents and settingsadministratorapplication datamicrosoftcryptneturlcachemetadata7b2238aaccedc3f1ffe8e7eb5f575ec9 Payload Allows backdoor access and control Backdoor:Win32/Cycbot.I allows unauthorized access and control of an affected computer. An attacker can perform any number of different actions on an affected computer using Backdoor:Win32/Cycbot.I. This could include, but is not limited to, the following actions:
Download and execute arbitrary files Upload files Spread to other computers using various methods of propagation Log keystrokes or steal sensitive data Modify system settings Run or terminate applications Delete files
This malware description was produced and published using our automated analysis system's examination of file SHA1 59d45ffabbf8e08c6632048b2c880901c4ee5072.

Last update 07 May 2019

 

TOP