Home / malware

PDF

Backdoor.Citrat

First posted on 13 August 2014.
Source: Symantec

Aliases :

There are no other names known for Backdoor.Citrat.

Explanation :

When the Trojan is executed, it creates the following files: %System%\[RANDOM CHARACTERS OR NUMBERS].exe%System%\[RANDOM CHARACTERS OR NUMBERS].dll
Next, the Trojan creates the following registry entry so that it runs every time Windows starts:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\"load"="%System%\[RANDOM CHARACTERS OR NUMBERS].exe"

The Trojan then connects to the following remote locations: chanxe.avstore.com.twnewb02.skypetm.com.twjackyandy.avstore.com.tw
The Trojan may then perform the following actions: Create a remote shellDownload and upload files

Last update 13 August 2014

 

TOP