Backdoor:Win32/Htbot

Installation

• %LOCALAPPDATA%\[random alphanumeric characters]\[concatenation of two existing executable files].exe
• %LOCALAPPDATA%\[random alphanumeric characters]\[concatenation of two existing executable files].exe

It modifies the registry so that it runs each time you start your PC. For example:

Payload

Allows backdoor access and control

This threat can give a malicious hacker access and control of your PC. They can then perform a number of different actions, including:

• Deleting files
• Downloading and running files
• Logging your keystrokes or stealing your sensitive data
• Modifying your system settings
• Running or stopping applications
• Spreading malware to other PCs
• Uploading files

• solocoufandle.com using port 80
• papausafr.com using port 80

It can stop some processes from running on your PC, including:

• fescom.exe

Bypasses firewall

This threat tries to bypass your firewall by modifying the registry. For example:

HKLM\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy

You might need to restore your Windows Firewall settings.

Additional information

Creates a mutex

This threat can create a mutex on your PC. For example:

• PB_MAIN_MUTEX_GL_63785462387

It might use this mutex as an infection marker to prevent more than one copy of the threat running on your PC.