This backdoor may be downloaded from remote sites by the following malware:
JS_DLOADER.AP
JS_DLOADER.GXS
JS_DLOADER.UOW
JS_LIANZONG.E
JS_REALPLAY.AT
JS_REALPLAY.CE
JS_SENGLOT.D
JS_VEEMYFULL.AA
VBS_PSYME.CSZ
It can also be downloaded from certain remote sites.
It drops files/components detected as the following:
TSPY_ONLINEG.RKQ
TSPY_ONLINEG.DKL
TROJ_ONLINEG.DKO
TROJ_ONLINEG.DKY
TROJ_AGENT.VXO
TSPY_ONLINEG.DJZ
TSPY_ONLINEG.DJR
TSPY_LEGMIR.YS
TSPY_ONLINEG.OZN
TROJ_ONLINEG.DJT
TSPY_ONLINEG.DJW
TSPY_FRETHOG.NS
TSPY_FRETHOG.NW
TSPY_FRETHOG.NY
TSPY_ONLINEG.DJX
TSPY_FRETHOG.NZ
TSPY_ONLINEG.DKC
TSPY_ONLINEG.RMM
TSPY_ONLINEG.DKJ
TSPY_ONLINEG.RKQ
TSPY_ONLINEG.DKL
It opens a random port to allow a remote user to connect to the affected system. Once a successful connection is established, the remote user executes the following commands on the affected system:
Download files
Get system information
Log keystrokes
Shutdown affected system
Terminate process
It accesses Web sites to download files detected as the following:
TROJ_PROXY.ZK
TROJ_SYSTEMHI.DK
TROJ_SYSTEMHI.DL
TROJ_SYSTEMHI.DM
TROJ_SYSTEMHI.DO
TROJ_SYSTEMHI.DP
TROJ_SYSTEMHI.DW
TROJ_SYSTEMHI.EA
TROJ_SYSTEMHI.EB
TROJ_SYSTEMHI.HK
TSPY_FRETHOG.HE
TSPY_FRETHOG.IH
TSPY_FRETHOG.MR
TSPY_FRETHOG.MX
TSPY_FRETHOG.NA
TSPY_FRETHOG.NO
TSPY_FRETHOG.NQ
TSPY_GAMEOL.AQ
TSPY_LEGMIR.RD
TSPY_ONLINEG.DJM
TSPY_ONLINEG.DJN
TSPY_ONLINEG.DJR
TSPY_ONLINEG.DJS
TSPY_ONLINEG.GKR
TSPY_ONLINEG.KQL
TSPY_ONLINEG.OZN
TSPY_ONLINEG.RKQ
TSPY_ONLINEG.RKQ
TSPY_ONLINEG.SCS
TSPY_ONLINEG.SCY
As a result, malicious routines of the downloaded files are exhibited on the affected system.
It terminates certain services if found on the system.


More...