BKDR64_KVNDM.E

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes commands from a remote malicious user, effectively compromising the affected system. It connects to a website to send and receive information. However, as of this writing, the said sites are inaccessible.

Arrival Details

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This backdoor adds the following mutexes to ensure that only one of its copies runs at any one time:

• Global\fmaopkf

Backdoor Routine

This backdoor executes the following commands from a remote malicious user:

• Gather System Information
  • System Language
  • Computer Name
  • OS Information (Architecture, Version)
  • Host Name
  • Processor Information
  • Current Memory Usage
  • Administrative Status
  • Driver Information (Letter, Type, Diskspace)
  • User Name
  • Removable Drives Connected
  • Ip Configuration
  • List Of Program Files
  • System Information (from systeminfo.exe)
  • SETAPI.Dev.Log Files
• Create Arbitrary Processes
• Execute arbitrary Power shell commands
  • Uses the command: "powershell –encodedcommand {data/code}"
• Download/Execute Arbitrary Plugins
• Uninstall itself
  • Drops and executes the following:
    • %User Temp%\xxm{random}.bat <- used to delete itself, deleted afterwards
• Change the Interval of activity time
• Change the C&C URL accessed
• Download and Execute arbitrary files
• Perform custom mimikatz metasploit commands
• Use “espia” commands to gather the following information:
  • Clipboard dump
  • Keyboard dump
  • Video/Image dump
• Use “stdapi” commands to execute the following:
  • Sleep
  • Shell commands
  • List Arbitrary Files/Drives/Directories
  • Upload/Download arbitrary files
  • Create, Delete, and Navigate through Files/Directories

(Note: %User Temp% is the user's temporary folder, where it usually is C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local\Temp on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

It connects to the following websites to send and receive information:

• http://{BLOCKED}i.{BLOCKED}n.com/howto/img/index.php?h={random hex value}&o=0&w={hex value based on system information}&a={communication type = (0/1/2)}&y=20000

However, as of this writing, the said sites are inaccessible.

Other Details

This backdoor does the following:

• The malware has an activity time from 00:00 to 24:00 based from its configuration