The backdoor has two parts: client and server.
The server, CppServer.exe, once executed, it will install itself to the Windows directory, and the server is executed on every system startup. When the server process
is running, it listen on port 65530, and wait for incoming connections.
When the server executable runs, the server creates a suspended svchost.exe, and then the server inject itself into the svchost.exe process, and the server code
executes in the address space of the svchost.exe process. This is technique called dynamic forking, also known as process hollowing.
1) Process hollowing on svchost.exe process.
2) Create processes.
4) Shutdown computer.
5) Restart computer.
6) Logoff user.
7) Force shutdown using NtShutdownSystem function.
8) Force restart using NtShutdownSystem function.
9) Wiping the MBR of the remote computer.
start [Program name]
Create a new process.
shellexecute [File name]
Open a file or website using ShellExecute function.
Shutdown the remote computer.
Restart the remote computer.
Logoff the remote computer.
Force shutdown the remote computer using NtShutdownSystem function.
Force restart the remote computer using NtShutdownSystem function.
Overwrite the MBR of the remote computer with garbage data, cause the remote computer unable to boot.
Native API functions used in server: