BKDR_CAPHAW.XBA

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes commands from a remote malicious user, effectively compromising the affected system.

It steals certain information from the system and/or the user.

It deletes the initially executed copy of itself.

Arrival Details

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This backdoor injects codes into the following process(es):

• explorer.exe

Autostart Technique

This backdoor adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
{random} = "%Application Data%\{random folder found}\{filename found in %System%}"

Other System Modifications

This backdoor adds the following registry entries:

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Main
NoProtectedModeBanner = "1"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings
DisableCachingOfSSLPages = "1"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings\
Zones\3
2500 = "3"

It modifies the following registry entries:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings\
Zones\3
1609 = "3"

(Note: The default value data of the said registry entry is 1.)

Backdoor Routine

This backdoor executes the following commands from a remote malicious user:

• Download and execute arbitrary files
• Upload files
• Update itself
• Modify system settings
• Terminate processes

It connects to the following URL(s) to send and receive commands from a remote malicious user:

• http://{BLOCKED}.{BLOCKED}.39.216:443
• http://{BLOCKED}.{BLOCKED}.185.19:443
• http://{BLOCKED}.{BLOCKED}.39.118:443
• http://{BLOCKED}.{BLOCKED}.184.178:443
• http://{BLOCKED}.{BLOCKED}.238.115:443
• http://{BLOCKED}.{BLOCKED}.50.200:443
• http://{BLOCKED}.{BLOCKED}.75.234:443

Information Theft

This backdoor steals the following information:

• CPU Information
• OS Version and Installation Information
• Disk Devices list, type and status
• Computer Name
• Admin Rights
• Code Page
• Web Browser Version (Internet Explorer, Firefox, Chrome)
• Anti-malware Software Installed
• Virtual Machine check
• Startup Programs
• VMWare Information
• Installed Software (found under HKEY_LOCAL_MACHINE\SOFTWARE registry subkey)
• Running Processes
• Cookies
• Network traffic

Other Details

This backdoor deletes the initially executed copy of itself

NOTES:

It drops a copy of itself in random legitimate folders or subfolders found in the %Application Data% folder. It uses the file name of a file found in the %System% folder (e.g., %Application Data%\Microsoft\Internet Explorer\logagent.exe).

If a connection to a C&C server is successful, it may download its components/configuration may contain information like targeted online banking sites.