Backdoor.Win64.TRUEBOT.YXDDY

This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes commands from a remote malicious user, effectively compromising the affected system. However, as of this writing, the said sites are inaccessible.

Arrival Details

This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Backdoor adds the following mutexes to ensure that only one of its copies runs at any one time:

• ASPODIKAFLKJoieLUFESJFuiewr

Backdoor Routine

This Backdoor executes the following commands from a remote malicious user:

• KLLS - terminate processes via cmd
• SHC - execute shellcode
• S64 - execute shellcode

It connects to the following URL(s) to send and receive commands from a remote malicious user:

• http://{BLOCKED}.com/dns.php

However, as of this writing, the said sites are inaccessible.

Dropping Routine

This Backdoor drops the following files:

• %All Users Profile%\{Random}.JSONIP - contains generated ID with format {0-9a-z}{8}-{0-9a-z}{8}

(Note: %All Users Profile% is the common user's profile folder, which is usually C:\Documents and Settings\All Users on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\ProgramData on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit). )

Information Theft

This Backdoor gathers the following data:

• Computer Name
• Workstation Information
• OS version
• System Architecture

Other Details

This Backdoor connects to the following URL(s) to check for an Internet connection:

• google.com

It checks for the presence of the following process(es):

• All running processes without the following strings in its filename:
  • AUDI
  • AUDIODG
  • CMD
  • CONHOST
  • CSRSS
  • CTFMON
  • DLLHOST
  • DWM
  • FONTDRVHOST
  • IBMPM
  • IGFX
  • LMS
  • LSASS
  • LSM
  • MEMORY
  • PLUGINHOST
  • POWERMGR
  • PRESENTATIONFONTCACHE
  • REGISTRY
  • RUNDLL32
  • RUNTIMEBROKER
  • SERVICE
  • SHELLEXPERIENCEHOST
  • SIHOST
  • SMSS
  • SPLWOW64
  • SPOOLSV
  • STARTMENUEXPERIENCEHOST
  • SVCHOST
  • SYSTEM
  • TABTIP
  • TASKHOSTW
  • TASKLIST
  • TEXTINPUTHOST
  • TIWORKER
  • TRUSTEDINSTALLER
  • USEROOBEBROKER
  • WININIT
  • WINLOGON
  • WLANEXT
  • WUDFHOST

It does the following:

• It checks for the presence of the following files upon execution:
  • FODSIKFODSIOFKDSOIFOSDIFODS.doc
  • %All Users Profile%\SqSjdQgzWPdzH.JSONIP
• It sends the gathered information and listed processes to its CnC.

(Note: %All Users Profile% is the common user's profile folder, which is usually C:\Documents and Settings\All Users on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\ProgramData on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit). )

It adds the following scheduled tasks:

• Task Name: MicrosoftEdgeUpdateTaskMachineCore{1575CC8A-457A-1700-652A-6BF2B031A266}
  Task to be run: %SysWOW64%\rundll32.exe /S {Malware File Path}\{Malware File Name},ChkdskExs
• Task Name: MicrosoftEdgeUpdateTaskMachineCore{1575CC8A-457A-1700-652A-6AF2B031A266}
  Task to be run: %SysWOW64%\rundll32.exe /S {Malware File Path}\{Malware File Name},ChkdskExs