BKDR_AGENTT.ZYA

This malware installs itself as an NTFS Alternate Data Stream (ADS) in certain directors in the affected system.

It executes malicious commands through command shell.

This backdoor does not have any propagation routine.

It does not have any downloading capability.

It does not have any information-stealing capability.

Arrival Details

This backdoor may be downloaded from the following remote sites:

• http://{BLOCKED}.{BLOCKED}.215.58:8080/update.exe

This malware arrives via the following means:

• via email messages spammed by other malware/grayware or malicious users.

Installation

This backdoor drops the following files:

• %User Temp%\dick.txt - configuration file
• %User Temp%\love.exe - also detected as BKDR_AGENTT.ZYA
• %Program Files%\Common Files\ODBC\OBDC.dat - copy of %User Temp%\dick.txt
• %Windows%\java\classes\jsb.cer - copy of %User Temp%\dick.txt

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003.. %Program Files% is the default Program Files folder, usually C:\Program Files.. %Windows% is the Windows folder, which is usually C:\Windows or C:\WINNT.)

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• lau's PI

It injects itself into the following processes as part of its memory residency routine:

• explorer.exe

Autostart Technique

This backdoor adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Active Setup\Installed Components\{8E12AADC-A55E-3FBE-4C6E-6B6EAC7CAFB5}
StubPath = %WINDOWS%:adobeupdate.exe

Propagation

This backdoor does not have any propagation routine.

Download Routine

This backdoor does not have any downloading capability.

Information Theft

This backdoor does not have any information-stealing capability.

NOTES:

Backdoor Routine

This backdoor opens a hidden Internet Explorer window.

It connects to the following websites to send and receive information:

• {BLOCKED}.{BLOCKED}.215.58

It executes malicious commands from its C&C through command shell. As per current analysis, the C&C issues a command to shutdown the affected system.

Other Details

It installs itself as an NTFS Alternate Data Stream (ADS) in the following directory:

• %Windows%

The ADS has the following name:

• %Windows%:adobeupdate.exe

It does not have rootkit capabilities.