SHA1:
- 6927c1a3f3c89cbfc8b618cb6eb568974d1aaec7
A backdoor Trojan for 64-bit versions of Microsoft Windows. To be able to exchange data with the command and control server, the Trojan uses the binary protocol. Information is encrypted with the algorithms RSA and AES.
Packages have headers with the following structure:
struct head_t
{
BYTE cmd; //command
BYTE ver; //version
DWORD size; //full size of transferred data
WORD part_size; //datablock size
WORD num; //datablock number
BYTE flag; //compression flag, termination of transmission
DWORD sess; //session id
DWORD unk1; //0
BYTE unk2; //0
DWORD unk3; //0
};
First, the header is sent, then—the datablock. They are encrypted separately.
The backdoor can perform the following commands on an infected device:
- Download files from a specific remote server;
- Upload files to a remote server;
- Launch a file on an infected device;
- Execute commands in the cmd.exe console;
- Redirect traffic between ports;
- Download and install its own modules.