Backdoor:Win32/Caphaw.K

Installation

Backdoor:Win32/Caphaw.K creates a new instance of "%WINDOWS%\svchost.exe" and injects itself into it. The trojan uses this code injection to run its code and to hinder detection and removal.

When run, the trojan creates a mutex that matches a random globally unique identifier (for example, "7CA7BF113BA3B73C45D937C0ECA3C59C3555316931"). It may do this to ensure that only one copy of the malware is running on your computer at any one time.

Payload

Allows backdoor access and control 

Backdoor:Win32/Caphaw.K allows unauthorized access and control of an affected computer. An attacker can perform any number of different actions on an affected computer using the backdoor. This could include, but is not limited to, the following actions:

In order to receive commands, we have observed this trojan attempt to connect to various remote sites, including the following:

• hxxps://online-upd.at/
• hxxps://stat-servise.cc
• hxxps://str-main.su

Analysis by Daniel Radu