Backdoor AQF

Alises: Backdoor.EggDrop (AVP), BackDoor.EggDrop (Dr.Web), Backdoor.EggDrop (Symantec)

There are three components of the backdoor, a configuration executable, a service executable and a backdoor dll. The configuration executable is command-line tool. It is used to configure the service executable and backdoor dll. Its action includes following:

• Set service executable name.
• Set backdoor server password when connected.
• Set backdoor server open port.
• Set email address and ICQ account for notification.
• Set service display name and description.
• Set system dll name to inject backdoor dll to.

Once the service executable is configured. It can run on nt/2000/xp machines. When run, it installs itself as a service on the local machine. It creates the following registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\WinEggDropShell