Backdoor.MSIL.ASYNCRAT.CC

This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It does not have any propagation routine.

It executes commands from a remote malicious user, effectively compromising the affected system. However, as of this writing, the said sites are inaccessible.

It gathers certain information on the affected computer.

Arrival Details

This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Backdoor drops a copy of itself in the following folders using different file names:

• %Application Data%\svchos.exe

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It drops the following files:

• %User Temp%\tmp{Random}.tmp.bat → used to execute %Application Data%\svchos.exe and delete itself
• %User Temp%\Log.tmp → contains key logs

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It adds the following processes:

• %System%\cmd.exe /c schtasks /create /f /sc onlogon /rl highest /tn "svchos" /tr "%Application Data%\svchos.exe" & exit → if malware is running as Administrator
• %System%\cmd.exe /c "%User Temp%\tmp{Random}.tmp.bat"

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• AsyncMutex_6SI8OkPnk

Autostart Technique

This Backdoor adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
svchos = %Application Data%\svchos.exe → if malware is not running as Administrator

Propagation

This Backdoor does not have any propagation routine.

Backdoor Routine

This Backdoor executes the following commands from a remote malicious user:

• anydesk, backproxy, getscreen, Killproxy, Net35, uacoff, WDExclusion → execute a plugin from the C&C server
• Avast, DiscordTokens, Chrome, Fox, passload, Wallets, WebBrowserPass → sends the hardware ID and execute a plugin from the C&C server
• Block → copies %System%\drivers\etc\hosts as %System%\drivers\etc\hosts.backup if %System%\drivers\etc\hosts.backup does not exist and then modifies %System%\drivers\etc\hosts. It also adds the following process: %System%\cmd.exe /c taskkill.exe /im chrome.exe /f
• gettxt → extracts and sends clipboard data
• killps → terminate processes by process names received from the C&C server
• klget → extracts and sends key logs from %User Temp%\Log.tmp
• plugin → if HKEY_CURRENT_USER\Software\{HWID} does not exist, it will execute a plugin from the C&C server
• pong → ping test
• ResetHosts → copies %System%\drivers\etc\hosts.backup as %System%\drivers\etc\hosts
• ResetScale → sets the screensaver timeout to 0
• saveplugin → creates a registry key under HKEY_CURRENT_USER\Software\{HWID} with values specified by the C&C server and execute a plugin from the C&C server
• setxt → clears or sets value of clipboard data depending on the value received from the C&C server
• weburl → downloads and executes a file specified from the C&C server

(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.. %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It connects to the following URL(s) to send and receive commands from a remote malicious user:

• tcp://{BLOCKED}.{BLOCKED}.{BLOCKED}.252:1339
• tcp://{BLOCKED}y.dynuddns.net:1339

However, as of this writing, the said sites are inaccessible.

Rootkit Capabilities

This Backdoor does not have rootkit capabilities.

Information Theft

This Backdoor gathers the following information on the affected computer:

• HWID = HWID generated from processor count, username, computer name, OS version, and total size of the system directory
• User = System Username
• OS = Operating System of affected system
• Path = Malware File Path
• Admin = Is malware executing as Administrator
• Performance = Current Active Window
• Antivirus = List of AV products installed
• If the following cryptocurrency wallet and 2FA browser extensions exists in the affected system:
  • Brave
  • Authenticator
  • MetaMask
  • Phantom
  • Chrome
  • Authenticator
  • Binance
  • BitKeep
  • BitPay
  • Coinbase
  • Exodus
  • MetaMask
  • Phantom
  • Ronin
  • TronLink
  • TrustWallet
  • Edge
  • Authenticator
  • Binance
  • MetaMask
  • Firefox
  • MetaMask
  • Opera
  • MetaMask
  • Opera GX
  • MetaMask
• If the following cryptocurrency applications exists in the affedted system:
  • Atomic
  • Binance
  • Bitcoin
  • Coinomi
  • Ergo Wallet
  • Electrum
  • Exodus
  • Ledger Live
• LastTime = Last activity time of the affected system

Other Details

This Backdoor does the following:

• It prevents the system from sleeping
• It terminates the following processes if the current malware file name is not %Application Data%\svchos.exe:
  • %Application Data%\svchos.exe
• It deletes files with the following file names if the current malware file name is not %Application Data%\svchos.exe:
  • %Application Data%\svchos.exe

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It does not exploit any vulnerability.

It adds the following scheduled tasks:

• If malware is running as Administrator:
  • Name: %Application Data%\svchos.exe
  • Trigger: At log on of any user
  • Action: %Application Data%\svchos.exe

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)