Backdoor.Win32.PIKABOT.C

This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Backdoor adds the following processes:

• %System%\SearchProtocolHost.exe → legitimate executable where it will inject the Pikabot core module
• whoami.exe /all
• ipconfig.exe /all
• netstat.exe -aon

(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.)

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• {A77FC435-31B6-4687-902D-24153579C738}

Information Theft

This Backdoor gathers the following data:

• OS Version
• Build Number
• Product Number
• User Name
• Computer Name
• CPU Name
• System Uptime
• GPU Name
• RAM Amount
• Screen Resolution
• Domain Controller Name
• Domain Controller Address
• Network Information
• User/Groups Information
• Running Processes

Stolen Information

This Backdoor sends the gathered information via HTTP POST to the following URL:

• http://{BLOCKED}.{BLOCKED}.{BLOCKED}.55:2225/cervicobrachial/oIP7xH86DZ6hb?vermixUnintermixed=beatersVerdigrisy&backoff=9zFPSr
• http://{BLOCKED}.{BLOCKED}.{BLOCKED}.25:2967/cervicobrachial/oIP7xH86DZ6hb?vermixUnintermixed=beatersVerdigrisy&backoff=9zFPSr
• http://{BLOCKED}.{BLOCKED}.{BLOCKED}.01:13720/cervicobrachial/oIP7xH86DZ6hb?vermixUnintermixed=beatersVerdigrisy&backoff=9zFPSr
• http://{BLOCKED}.{BLOCKED}.{BLOCKED}.100:13721/cervicobrachial/oIP7xH86DZ6hb?vermixUnintermixed=beatersVerdigrisy&backoff=9zFPSr
• http://{BLOCKED}.{BLOCKED}.{BLOCKED}.139:2222/cervicobrachial/oIP7xH86DZ6hb?vermixUnintermixed=beatersVerdigrisy&backoff=9zFPSr
• http://{BLOCKED}.{BLOCKED}.{BLOCKED}.156:2078/cervicobrachial/oIP7xH86DZ6hb?vermixUnintermixed=beatersVerdigrisy&backoff=9zFPSr
• http://{BLOCKED}.{BLOCKED}.{BLOCKED}.190:2223/cervicobrachial/oIP7xH86DZ6hb?vermixUnintermixed=beatersVerdigrisy&backoff=9zFPSr

Other Details

This Backdoor does the following:

• After sending the gathered information, the malware's behavior will depend on the response of the C&C server. However, as of this writing, the said sites are inaccessible
• It checks if the following virtual machine, sandbox, or security program related module(s) is loaded in the affected system:
  • cmdvrt.32.dll
  • cmdvrt.64.dll
  • dbghelp.dll
  • cuckoomon.dll
  • pstorec.dll
  • avghookx.dll
  • avghooka.dll
  • snxhk.dll
  • api_log.dll
  • dir_watch.dll
  • wpespy.dll
  • kernel32.dll
  • networkexplorer.dll
  • NlsData0000.dll
  • NetProjW.dll
  • Ghofr.dll
  • fg122.dll
• It terminates if the system default language is one of the following:
  • Russian
  • Ukrainian