BKDR_KULUOZ.SM15

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes commands from a remote malicious user, effectively compromising the affected system. It connects to a website to send and receive information.

Arrival Details

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This backdoor drops the following copies of itself into the affected system:

• %AppDataLocal%\{random filename}.exe

(Note: %AppDataLocal% is the Application Data folder found in Local Settings, where it is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

It adds the following processes:

• svchost.exe

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• aa{User Name}
• ab{User Name}

It injects itself into the following processes as part of its memory residency routine:

• created svchost.exe

Autostart Technique

This backdoor adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
{random} = "%AppDataLocal%\{random filename}.exe"

Other System Modifications

This backdoor adds the following registry keys:

HKEY_CURRENT_USER\SOFTWARE\{random}

It adds the following registry entries:

HKEY_CURRENT_USER\SOFTWARE\{random}
{random} = "{hex values}"

Backdoor Routine

This backdoor executes the following commands from a remote malicious user:

• idl - sleep/idle
• run - download and execute arbitrary file
• rem - uninstall itself
• rdl - update copy of injected code in svchost and add encrypted code to registry
• upd - update copy of main malware
• red - edit registry
• ear - update copy of malware and autorun registry entry

It connects to the following websites to send and receive information:

• http://{BLOCKED}.{BLOCKED}.78.225:8080/index.php
• http://{BLOCKED}.{BLOCKED}.37.14:443/index.php
• http://{BLOCKED}.{BLOCKED}.210.196:3128/index.php
• http://{BLOCKED}.{BLOCKED}.238.77:8080/index.php
• http://{BLOCKED}.{BLOCKED}.147.7:8080/index.php
• http://{BLOCKED}.{BLOCKED}.19.242:8080/index.php
• http://{BLOCKED}.{BLOCKED}.42.104:8080/index.php

NOTES:

It checks if there's a running window with the following name:

• wireshark.exe
• Tfrmrpcap
• iptools.exe
• Iris - Version 5.59
• ProcessLasso_Notification_Class
• TSystemExplorerTrayForm.UnicodeClass
• PROCMON_WINDOW_CLASS
• PROCEXPL
• WdcWindow
• ProcessHacker
• 99929D61-1338-48B1-9433-D42A1D94F0D2-x64
• 99929D61-1338-48B1-9433-D42A1D94F0D2-x32
• 99929D61-1338-48B1-9433-D42A1D94F0D2
• Dumper
• Dumper64
• APISpy32Class
• VMwareDragDetWndClass
• VMwareSwitchUserControlClass
• vmtoolsd.exe
• prl_cc.exe
• prl_tools.exe
• SharedIntApp.exe
• VBoxTray.exe
• VBoxService.exe
• vmusrvc.exe
• vmsrvc.exe

It checks the Service Disk or Bios registries if the following is under Virtualization:

• VMWare
• PTLTD
• Virtual
• PRLS
• Vbox
• AMIBI

It checks if the following registry keys exist:

• SYSTEM\CurrentControlSet\Enum\PCI\VEN_15ADDEV_0774SUBSYS_040515ADREV_00
• SYSTEM\CurrentControlSet\Enum\PCI\VEN_15ADDEV_0774SUBSYS_074015ADREV_00
• SYSTEM\CurrentControlSet\Enum\PCI\VEN_5333DEV_8811SUBSYS_00000000REV_00
• SYSTEM\CurrentControlSet\Enum\PCI\VEN_80EESUBSYS_00000000REV_00
• SYSTEM\CurrentControlSet\Enum\PCI\VEN_80EESUBSYS_00000000REV_00
• HARDWARE\ACPI\DSDT\PTLTD__
• HARDWARE\ACPI\DSDT\VBOX__
• HARDWARE\ACPI\DSDT\AMIBI