BKDR_CUTWAIL.AAW

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. It may be downloaded by other malware/grayware from remote sites.

It executes commands from a remote malicious user, effectively compromising the affected system. It connects to a website to send and receive information.

It gathers certain information on the affected computer.

It deletes itself after execution.

Arrival Details

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It may be downloaded by the following malware/grayware from remote sites:

• TROJ_UPATRE.AAW

Installation

This backdoor drops the following copies of itself into the affected system and executes them:

• %User Profile%\{random}.exe
• %System%\{random}.exe

(Note: %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003, or C:\Users\{user name} on Windows Vista and 7.. %System% is the Windows system folder, which is usually C:\Windows\System32.)

It adds the following processes:

• svchost.exe

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• CTR.{16 alphanumeric characters}

It injects itself into the following processes as part of its memory residency routine:

• created svchost.exe

Autostart Technique

This backdoor adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Run
{random} = "%System%\{random}.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
{random} = "%User Profile%\{random}.exe"

Other System Modifications

This backdoor adds the following registry entries:

HKEY_LOCAL_MACHINE\Software\WinNTData
prx = "{Hex Values}"

It adds the following registry keys as part of its installation routine:

HKEY_LOCAL_MACHINE\Software\WinNTData

Backdoor Routine

This backdoor executes the following commands from a remote malicious user:

• Download and Execute File
• Load Modules
• Configure Proxy Settings
• Execute Arbitrary Codes
• Terminate Self

It connects to the following websites to send and receive information:

• BLOCKED}.{BLOCKED}.90.125:443
• {BLOCKED}.{BLOCKED}.172.129:443
• {BLOCKED}.{BLOCKED}.104.81:443
• {BLOCKED}.{BLOCKED}.94.182:443
• {BLOCKED}.{BLOCKED}.198.93:443
• {BLOCKED}.{BLOCKED}.33.125:443
• {BLOCKED}.{BLOCKED}.36.184:443

Information Theft

This backdoor gathers the following information on the affected computer:

• System Bios
• Video Bios
• CPU
• Product ID

Other Details

This backdoor deletes itself after execution.