Home / malware Backdoor.Comdinter
First posted on 05 March 2014.
Source: SymantecAliases :
There are no other names known for Backdoor.Comdinter.
Explanation :
When executed, the Trojan creates following registry entry so that it runs every time Windows starts:
HKEY_CURRENT_USER\Microsoft\Windows\CurrentVersion\Run\"SVC_Host" = "[PATH TO THREAT]"
It then attempts to connect to the following URL in order to check network connectivity:
http://www.google.com
The Trojan then opens a back door on the compromised computer and connects to the following location to receive commands:
[http://]37.59.237.106Last update 05 March 2014
