BKDR_KULUOZ.VLU

This malicious file is downloaded from cloaked URLs in spammed emails related to fake Viber applications

This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes commands from a remote malicious user, effectively compromising the affected system. It connects to a website to send and receive information.

Arrival Details

This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It may be downloaded from the following remote site(s):

• http://{BLOCKED}hosting.biz.ht/object.php?vib=61+pbq2ZRacFdllkhKRYLw

Installation

This Backdoor drops the following copies of itself into the affected system and executes them:

• %AppDataLocal%\{random file name}.exe

(Note: %AppDataLocal% is the Local Application Data folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local on Windows Vista, 7, and 8.)

It adds the following processes:

• svchost.exe

It stays memory-resident by injecting codes into the following processes:

• created svchost.exe

Autostart Technique

This Backdoor adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
{random} = "%AppDataLocal%\{random file name}.exe"

Other System Modifications

This Backdoor adds the following registry keys:

HKEY_CURRENT_USER\Software\{random}

It adds the following registry entries:

HKEY_CURRENT_USER\Software\{random}
{random} = "{hex values}"

Backdoor Routine

This Backdoor executes the following commands from a remote malicious user:

• Sleep/Idle
• Download and execute arbitrary file
• Uninstall itself
• Download module and inject to svchost.exe
• Update itself
• Check latest malware version
• Manage registry

It connects to the following websites to send and receive information:

• http://{BLOCKED}.{BLOCKED}.182.152:8080/index.php
• http://{BLOCKED}.{BLOCKED}.126.139:443/index.php
• http://{BLOCKED}.{BLOCKED}.21.210:443/index.php
• http://{BLOCKED}.{BLOCKED}.239.167:8080/index.php
• http://{BLOCKED}.{BLOCKED}.138.62:8080/index.php
• http://{BLOCKED}.{BLOCKED}.84.84:8080/index.php
• http://{BLOCKED}.{BLOCKED}.105.170:8080/index.php
• http://{BLOCKED}.{BLOCKED}.189.52:8080/index.php
• http://{BLOCKED}.{BLOCKED}.147.192:8080/index.php

Information Theft

This Backdoor gathers the following data:

• Malware version
• Virtualization information
• Running debugger/forensic tools
• User name
• Local IP address
• Processor type
• OS version
• Antivirus product
• Firewall product

NOTES:

This backdoor checks if there's a running window with the following names:

• 99929D61-1338-48B1-9433-D42A1D94F0D2
• 99929D61-1338-48B1-9433-D42A1D94F0D2-x32
• 99929D61-1338-48B1-9433-D42A1D94F0D2-x64
• APISpy32Class
• Dumper
• Dumper64
• iptools.exe
• Iris - Version 5.59
• prl_cc.exe
• prl_tools.exe
• ProcessHacker
• ProcessLasso_Notification_Class
• PROCEXPL
• PROCMON_WINDOW_CLASS
• SharedIntApp.exe
• Tfrmrpcap
• TSystemExplorerTrayForm.UnicodeClass
• VBoxService.exe
• VBoxTray.exe
• vmsrvc.exe
• vmtoolsd.exe
• vmusrvc.exe
• VMwareDragDetWndClass
• VMwareSwitchUserControlClass
• WdcWindow
• wireshark.exe

It checks Service Disk or BIOS for the following registry information if under virtualization:

• AMIBI
• PRLS
• PTLTD
• Vbox
• Virtual
• VMware