Win32/Sabresac [Threat Name] go to Threat

Win32/Sabresac.C [Threat Variant Name]

Category	trojan
Size	363045 B

Win32/Sabresac.C serves as a backdoor. It can be controlled remotely.

When executed, the trojan copies itself into the following location:

The trojan registers itself as a system service using the following name:

The following Registry entries are set:

A string with variable content is used instead of %variable1%, %d% .

The trojan collects the following information:

The trojan attempts to send gathered information to a remote machine.

The trojan acquires data and commands from a remote computer or the Internet.

The trojan contains a list of (5) URLs. The TCP, HTTP protocol is used in the communication.

It can execute the following operations:

The trojan creates the following folders:

A string with variable content is used instead of %variable% .