BKDR_CARBANAK.C

This is the latest CARBANAK variant reportedly related to the compromised Microsoft Windows client. CARBANAK is a malware family that hits banks and financial organizations.

To get a one-glance comprehensive view of the behavior of this Backdoor, refer to the Threat Diagram shown below.

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes commands from a remote malicious user, effectively compromising the affected system. It connects to a website to send and receive information.

It deletes itself after execution.

Arrival Details

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This backdoor drops the following copies of itself into the affected system:

• %All Users Profile%\Application Data\Mozilla\svchost.exe - for Windows XP and prior OS versions
• %ProgramData%\Mozilla\svchost.exe - for Windows Vista and later OS versions

(Note: %All Users Profile% is the All Users folder, where it usually is C:\Documents and Settings\All Users on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\ProgramData on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.. %ProgramData% is the Program Data folder, where it usually is C:\Program Files in Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\ProgramData in Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

It creates the following folders:

• %All Users Profile%\Application Data\Mozilla - for Windows XP and later OS versions
• %ProgramData%\Mozilla - for Windows 7 and later OS versions

(Note: %All Users Profile% is the All Users folder, where it usually is C:\Documents and Settings\All Users on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\ProgramData on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.. %ProgramData% is the Program Data folder, where it usually is C:\Program Files in Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\ProgramData in Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

It injects codes into the following process(es):

• created svchost.exe

Autostart Technique

This backdoor registers itself as a system service to ensure its automatic execution at every system startup by adding the following registry entries:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\{random service name}Sys
ImagePath = "%ProgramData%\Mozilla\svchost.exe - for Windows Vista and later OS versions"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\{random service name}Sys
ImagePath = "%All Users Profile%\Application Data\Mozilla\svchost.exe - for Windows XP and prior OS versions"

It registers as a system service to ensure its automatic execution at every system startup by adding the following registry keys:

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\{random service name}Sys

Backdoor Routine

This backdoor executes the following commands from a remote malicious user:

• Capture and send screenshots
• Capture and send video
• Download configuration file
• Download and execute arbitrary files
• Download third party remote desktop protocol software that will be used for remote access
• Update itself
• Restart the machine
• Check state of malware

It connects to the following websites to send and receive information:

• http://{BLOCKED}.{BLOCKED}.167.28:443

It posts the following information to its command and control (C&C) server:

• OS version
• number of processors
• computer name
• username
• current time

Other Details

This backdoor drops the following file(s)/component(s):

• %All Users Profile%\Application Data\Mozilla\{random file name}.bin - for Windows XP and prior OS versions
• %Program Data%\Mozilla\{random file name}.bin - for Windows Vista and laterr OS versions

(Note: %All Users Profile% is the All Users folder, where it usually is C:\Documents and Settings\All Users on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\ProgramData on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

It deletes itself after execution.

NOTES:

The dropped component contains backdoor commands.