Backdoor.Win32.SDDOS.A

This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes commands from a remote malicious user, effectively compromising the affected system.

Arrival Details

This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Backdoor drops the following files:

• %Application Data%\WindowsUpdata\.temp.fortest - main malware was ran without admin privilege
• %Windows%\WindowsUpdata\.temp.fortest - main malware was ran with admin privilege

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %Windows% is the Windows folder, where it usually is C:\Windows on all Windows operating system versions.)

It drops and executes the following files:

• %Application Data%\WindowsUpdata\{random}.exe - main malware was ran without admin privilege
• %Windows%\WindowsUpdata\{random}.exe - main malware was ran with admin privilege

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %Windows% is the Windows folder, where it usually is C:\Windows on all Windows operating system versions.)

It adds the following processes:

• %System%\cmd.exe /c del {Malware path and name} > nul - delete original malware

(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.)

It creates the following folders:

• %Application Data%\WindowsUpdata - main malware was ran without admin privilege
• %Windows%\WindowsUpdata - main malware was ran with admin privilege

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %Windows% is the Windows folder, where it usually is C:\Windows on all Windows operating system versions.)

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• siukit.cn

Autostart Technique

This Backdoor adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Run
{Random Malware Name}.exe = %Windows%\WindowsUpdata\{random}.exe - main malware was ran with admin privilege

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Run
{Random Malware Name}.exe = %Application Data%\WindowsUpdata\{Random}.exe - main malware was ran without admin privilege

Other System Modifications

This Backdoor modifies the following registry entries:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
UACDisableNotify = 0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Policies\
System
EnableLUA = 0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Policies\
System
PromptOnSecureDesktop = 0

Backdoor Routine

This Backdoor executes the following commands from a remote malicious user:

• Perforn DDoS Attacks on specific IP address
• Download files

It connects to the following URL(s) to send and receive commands from a remote malicious user:

• {BLOCKED}.{BLOCKED}.133.49:2553

Denial of Service (DoS) Attack

This Backdoor is capable of performing various network denial-of-service (DoS) attacks:

• {BLOCKED}.{BLOCKED}.153.99:1024
• {BLOCKED}.{BLOCKED}.210.236:1024

Information Theft

This Backdoor gathers the following data:

• Windows Version
• Current Memory Usage
• System Hardware Information
• Username
• Computer name
• IP address

Other Details

This Backdoor does the following:

• It requires the following file in order to perform its other routines:
  • Config.ini
• It sends the gathered information to its server.