Backdoor.Win32.ZARDOOR.A

This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. It may be dropped by other malware.

It executes commands from a remote malicious user, effectively compromising the affected system.

Arrival Details

This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It may be dropped by the following malware:

• Trojan.Win32.ZARLOADR.B

Installation

This Backdoor adds the following processes:

• cmd /c wmic csproduct get indentifyingnumber

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• 3e603a07-7b2d-4a15-afef-7e9a0841e4d5
• ThreadMutex12453
• rrx_{4 digit number}
• mutex_pro

Backdoor Routine

This Backdoor executes the following commands from a remote malicious user:

• Encrypt and send data to its C2 server
• Execute remotely fetched PE payload
• Search for session ID
• Plugin exit
• Remote shellcode execution
• Delete itself
• Update C2 IP()IP/domain_name:port)
• Do nothing

It connects to the following URL(s) to send and receive commands from a remote malicious user:

• {BLOCKED}.{BLOCKED}.{BLOCKED}.1/index.html
• {BLOCKED}.{BLOCKED}.{BLOCKED}.2/index.html
• {BLOCKED}.{BLOCKED}.{BLOCKED}.3/index.html

Information Theft

This Backdoor gathers the following data:

• Windows Version
• Operating System
• Hostname
• Computer name
• Username
• SID number

Other Details

This Backdoor does the following:

• It needs a program that allows network applications to operate through a SOCKS or HTTPS proxy to establish its connection to its C2