Brador Trojan Targets Microsoft Pocket PC Handhelds

Kaspersky Labs has detected Backdoor.WinCE.Brador.a, the first backdoor Trojan for PDAs running under PocketPC, a Microsoft (Nasdaq: MSFT) handheld operating system originally known as Windows CE. Brador is a classic Trojan backdoor program: It opens the infected machine for remote administration.

After the backdoor is launched, it creates an svchost.exe file in the Windows autorun folder, thus maintaining full control over the system every time the handheld is turned on.

Brador then identifies the machine's IP address and sends it to the author, informing the author that the handheld is connected to the Internet and the backdoor is active. Finally, Brador opens port 2989 and awaits further commands.

Brador is created to allow the master full control over the infected PDA via the port that the Trojan opens. Brador is programmed to upload and download files and execute a series of further commands.

Brador Cannot Spread by Itself

Like all backdoors, Brador cannot spread by itself: It can only arrive as an e-mail attachment, be downloaded from the Internet or uploaded along with other data from a desktop.

"We were certain that a viable malicious program for PDAs would appear soon after the first proof of concept viruses emerged for mobile phones and Windows Mobile," commented Eugene Kaspersky, head of antivirus research at Kaspersky Labs. "WinCE.Brador.a is a full-scale malicious program ready to go: unlike proof of concept malware, Brador has a complete set of destructive functions typical for backdoors."

According to information received by the Kaspersky Virus Lab, Brador was probably written by a Russian virus coder. The Trojan was attached to an email with a Russian sender address and Russian text inside.

Brador Author

Interestingly enough, the author is offering to sell the client part for the Trojan to all interested parties, which means that there is a real chance that the backdoor might be bought by somebody who will use it commercially. Virus writers are turning professional with a vengeance.

"PDA users face a real danger and we can be sure that the computer underground will snatch at the chance to attack PDAs and mobile phones in the nearest future," added Kaspersky. "Malware development for mobiles is passing through the same stages as malware for desktops. We will probably see a serious outbreak of viruses for handhelds sometime soon."

Kaspersky Labs has already updated the antivirus databases with protection against Brador.