BKDR_AFCORE.SMA2

This malware is a component of another malware.

It attaches itself to certain processes.

It monitors the browsing activities of the user.

It exectures certain commands from a remote malicious user.

This backdoor may arrive bundled with malware packages as a malware component. It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It is a component of other malware.

It opens a random port to allow a remote user to connect to the affected system. Once a successful connection is established, the remote user executes commands on the affected system.

It requires its main component to successfully perform its intended routine.

Arrival Details

This backdoor may arrive bundled with malware packages as a malware component.

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This backdoor drops the following non-malicious files:

• %System%\{random filename 1}.dat
• %System%\{random filename 2}.dat
• %System%\{random filename 3}.dat
• %System%\{random filename 4}.dat
• %Current%\{malware filename}.dat

(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.)

It drops the following copies of itself into the affected system:

• %System%\{random filename 3}.ocx

(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.)

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• Global\{random characters}
• Local\{random characters}

It is a component of other malware.

Autostart Technique

This backdoor adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CLASSES_ROOT\CLSID\{random CLSID}\
InprocServer32
(default} = {malware path and filename}

HKEY_CLASSES_ROOT\CLSID\{random CLSID}\
InprocServer32
(default) = %System%\{random filename 3}.ocx

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Winlogon\
Notify\{malware filename}
DllName = {malware path and filename}

Other System Modifications

This backdoor adds the following registry keys as part of its installation routine:

HKEY_CLASSES_ROOT\CLSID\{random CLSID}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\
ShellIconOverlayIdentifiers\{malware filename}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\
ShellIconOverlayIdentifiers\{random filename 3}

Backdoor Routine

This backdoor opens a random port to allow a remote user to connect to the affected system. Once a successful connection is established, the remote user executes commands on the affected system.

Other Details

This backdoor requires its main component to successfully perform its intended routine.

NOTES:

This file is a component of another malware that may be used to log user activities in the system.

• *\explorer.exe
• *\intern*\iexplore.exe
• *\firefox.exe*\opera.exe
• *\outlook.exe
• *\outloo*\msimn.exe

• *.nhs.net/*
• *.nhs.uk/*
• *.hilton.*
• *.yahoo.*
• *.google.*

• ADDTO
• DELCOOKIES
• DELFROM
• DISKFLOOD
• DISKUNFLOOD
• EXPORT
• IPHLP
• IPHLPA
• IPHLPF
• LISTCOOKIES
• LSTWND
• MULTICAST
• PERFRM
• RESOLVE
• RESPAWN
• RESTART
• RMOLD
• RUNDLL
• SETCOOKIE
• SETRADIUS
• SETRANGE
• SETSP
• SETSP3
• SETSTR
• SETWND
• SHUTDOWN
• STATS
• UNFREEZE
• UNIFORG
• UNINSTALL

• Open, Create, Rename, Delete files/registries
• Scan drives
• Shutdown affected machine
• Shutdown, restart, or respawn itself
• Terminate processes