BKDR_VENIK

This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. It may be downloaded by other malware/grayware from remote sites. It may be unknowingly downloaded by a user while visiting malicious websites.

It injects its dropped file/component to specific processes.

It executes commands from a remote malicious user, effectively compromising the affected system. However, as of this writing, the said sites are inaccessible.

It deletes itself after execution.

Arrival Details

This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It may be downloaded by the following malware/grayware from remote sites:

• WORM_SMALL.ECD

It may be unknowingly downloaded by a user while visiting malicious websites.

Installation

This Backdoor drops the following files:

• %Windows%\{number}_Ss.dll - also detected as BKDR_VENIK.AE

(Note: %Windows% is the Windows folder, where it usually is C:\Windows on all Windows operating system versions.)

It adds the following processes:

• cmd.exe /c del {malware path}\{malware filename}.exe

It injects its dropped file/component to the following processes:

• svchost.exe

Other System Modifications

This Backdoor modifies the following registry entries:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\SvcHost
netsvcs = "{default value} netsvcs_0x0"

(Note: The default value data of the said registry entry is {default value}.)

It creates the following service using its DLL component:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\apagent\Parameters
ServiceDll = "%Windows%\{number}_Ss.dll"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\apagent
DisplayName = "netsvcs_0x0"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\apagent
ErrorControl = "1"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\apagent
ImagePath = "%SystemRoot%\System32\svchost.exe -k netsvcs"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\apagent
Start = "2"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\apagent
Type = "20"

Backdoor Routine

This Backdoor executes the following commands from a remote malicious user:

• Create processes
• Download and execute files
• Get OS Version
• Get Host Name
• Shutdown Computer
• Delete services
• execute iexplorer.exe
• Send stolen information

It connects to the following URL(s) to send and receive commands from a remote malicious user:

• yctou.{BLOCKED}u.com:337

However, as of this writing, the said sites are inaccessible.

Information Theft

This Backdoor gathers the following data:

• OS Version
• Host Name
• System Information
• Drive Information

Other Details

This Backdoor deletes itself after execution.