WinCE.Brador.a - first malicious PPC Trojan

Colin Dunstan · 08-07-2004, 09:21 AM

According to Eugene Kaspersky, head of antivirus research at Kaspersky Labs, WinCE.Brador.a is a full-scale malicious program ready to go: unlike proof-of-concept malware, Brador has a complete set of destructive functions typical for backdoors.

The Backdoor.WinCE.Brador.a Trojan installs as a 5632 byte program on the PDA, and can be used to gain complete control of file uploads and downloads. The virus cannot spread by itself. Instead it can only arrive as an email attachment, as a download from the internet or as an upload along with other data from a desktop. Once activated it creates a file called svchost.exe in the Autorun directory and sends the computer's IP address to the Trojan controller. It then opens port 44299 and listens for instructions.

cbarnett · 08-08-2004, 10:47 PM

[snip!] oops, double posted my response... look on...

cbarnett · 08-08-2004, 10:48 PM

This is a bit of a worry. I'm a bit saddened that this rubbish has finally made it's way to PDA's.... Now it's just matter of time before Palms get the shaft too, I guess.

And now I'll need a virus scanner for my ipaq

Craig.

08-07-2004, 09:21 AM	#1
Colin Dunstan Is papyrophobic! Posts: 1,926 Karma: 1009999 Join Date: Aug 2003 Location: USA Device: Dell Axim	WinCE.Brador.a - first malicious PPC Trojan According to Eugene Kaspersky, head of antivirus research at Kaspersky Labs, WinCE.Brador.a is a full-scale malicious program ready to go: unlike proof-of-concept malware, Brador has a complete set of destructive functions typical for backdoors. The Backdoor.WinCE.Brador.a Trojan installs as a 5632 byte program on the PDA, and can be used to gain complete control of file uploads and downloads. The virus cannot spread by itself. Instead it can only arrive as an email attachment, as a download from the internet or as an upload along with other data from a desktop. Once activated it creates a file called svchost.exe in the Autorun directory and sends the computer's IP address to the Trojan controller. It then opens port 44299 and listens for instructions.

08-08-2004, 10:47 PM	#2
cbarnett MR prodigal son Posts: 1,085 Karma: 1083739 Join Date: Mar 2003 Location: Australia Device: Kobo Aura H2O	[snip!] oops, double posted my response... look on... Last edited by cbarnett; 08-08-2004 at 10:49 PM.

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
Trojan warning when install beta3	droople	Sigil	1	05-01-2010 08:40 AM
Is this Apple's e-book trojan horse?	spinoza	News	25	09-25-2009 10:53 AM
trojan in calibre 0.5.11?	BookLoverToo	Calibre	5	05-10-2009 02:49 AM
Beware -- Trojan virus in 0.5.9	nathantw	Calibre	2	04-30-2009 04:31 PM
Kindle e-reader: A Trojan horse for free thought	twister	Amazon Kindle	2	03-19-2009 03:03 PM

08-08-2004, 10:48 PM	#3
cbarnett MR prodigal son Posts: 1,085 Karma: 1083739 Join Date: Mar 2003 Location: Australia Device: Kobo Aura H2O	This is a bit of a worry. I'm a bit saddened that this rubbish has finally made it's way to PDA's.... Now it's just matter of time before Palms get the shaft too, I guess. And now I'll need a virus scanner for my ipaq Craig.

Advert