BKDR_SINOWAL.COP

This backdoor may be downloaded by other malware/grayware/spyware from remote sites.

It executes commands from a remote malicious user, effectively compromising the affected system.

Arrival Details

This backdoor may be downloaded by other malware/grayware/spyware from remote sites.

Installation

This backdoor drops the following files:

• %All Users Profile%\Application Data\{random number 1}\{random number}.dat - contains hex value of its file name
• %All Users Profile%\Application Data\{random number 1}\{random number}.dll - contains hex value of its file name
• %All Users Profile%\Application Data\{random number 1}\{dat name}.dat - config file
• %All Users Profile%\Application Data\{random number 1}\{dll name}.dll - also detected as BKDR_SINOWAL.COP

(Note: %All Users Profile% is the All Users or Common profile folder, which is C:\Documents and Settings\All Users in Windows 2000, XP, and Server 2003, and C:\ProgramData in Windows Vista and 7.)

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• PJYTYOCEBHBSCAJFEJTLTHSCBHEBY
• KDACHIQCQPAXYBVCXUPYXFYCSQWR
• KDACHIQCQPAXYBVCXUPYXFYCSQWR-{number}

Autostart Technique

This backdoor adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CLASSES_ROOT\CLSID\{GUID}\
InprocServer32
(Default) = "%All Users Profile%\Application Data\{random number 1}\{dll name}.dll"

HKEY_CURRENT_USER\Software\Classes\
CLSID\{GUID}\InprocServer32
(Default) = "%All Users Profile%\Application Data\{random number 1}\{dll name}.dll"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\ShellServiceObjectDelayLoad
{value name} = "{GUID}"

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\Windows
AppInit_DLLs = "%All Users Profile%\Application Data\{random number 1}\{dll name}.dll"

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\Windows
LoadAppInitDLLs = "1"

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\Windows
RequireSignedAppInit_DLLs = "0"

Backdoor Routine

This backdoor executes the following commands from a remote malicious user:

• Download arbitrary files

It connects to the following URL(s) to send and receive commands from a remote malicious user:

• http://{BLOCKED}stingmultiformat.org/search2?fr=altavista&itag=ody&q=443b40b41d25b91dd9a4104278083c14%2Cf4f535b835f5429b&kgs=1&kls=0&p={parameter}
• http://{BLOCKED}.{BLOCKED}.109.201/search2?fr=altavista&itag=ody&q=443b40b41d25b91dd9a4104278083c14%2Cf4f535b835f5429b&kgs=1&kls=0&p={parameter}
• http://www.{BLOCKED}rtsgm.com/search2?fr=altavista&itag=ody&q=443b40b41d25b91dd9a4104278083c14%2Cf4f535b835f5429b&kgs=1&kls=0&p={parameter}

It posts the following information to its command and control (C&C) server:

• List of running processes
• Applications installed in the system (found in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall)

As of this writing, the said servers are currently inaccessible.

NOTES:

This backdoor suspends the thread of Trusteer Rapport program if it finds the said thread running in the processes of the following browsers:

• opera.exe
• chrome.exe
• firefox.exe
• iexplore.exe

It displays a message box with the following contents if the file avgui.exe is running in the system:

Title: Thank you
Message: Thank you for using AVG Product!

{dll name} can be any of the following:

• mswd
• mscc
• msdr
• msdd
• msee
• wsse
• msseedir
• lmbd
• mmdd

{dat name} can be any of the following:

• jdlr
• elct
• nudr
• werr
• qnud
• xdor
• ccdxmmde
• vvve
• kdkd
• colu
• uloc
• drss
• rrxx
• du44
• xes2
• ii33
• ned9
• i3u4

{GUID} can be any of the following:

• {A12BEDCC-A901-4203-B4F2-ADCB957D1887}
• {212B3DCC-A901-4203-B4F2-ADCB957D1887}
• {312BFDCE-A901-4203-B4F2-ADCB957D1887}
• {F12BE2CC-A901-4203-B4F2-ADCB957D1887}
• {312BED3C-A901-4203-B4F2-ADCB957D1887}
• {118BEDCC-A901-4203-B4F2-ADCB957D1887}

{value name} can be any of the following:

• MSCPY
• CopierMircosoft
• MSCopy
• MicrosoftCopy
• WindowsCopy
• Copier

This backdoor executes its DLL component by using the following command:

%System%\cmd.exe /c %System%\regsvr32.exe /s "%All Users Profile%\Application Data\{dll name}.dll"