BKDR_CYCBOT.BC

This backdoor connects to certain URLs. It may do this to remotely inform a malicious user of its installation. It may also do this to download possibly malicious files onto the computer, which puts the computer at a greater risk of infection by other threats. It executes the downloaded files. As a result, malicious routines of the downloaded files are exhibited on the affected system.

Autostart Technique

This backdoor adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows NT\CurrentVersion\Winlogon
Shell = %Application Data%\Microsoft\Windows\shell.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
svchost = %Application Data%\Microsoft\svchost.exe

It modifies the following registry entries to ensure it automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows NT\CurrentVersion\Windows
load = %User Temp%\dwm.exe

(Note: The default value data of the said registry entry is {blank}.)

Other System Modifications

This backdoor adds the following registry entries:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings
ProxyServer = http=127.0.0.1:50370

It modifies the following registry entries:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings
ProxyEnable = 1

(Note: The default value data of the said registry entry is 0.)

HKEY_CURRENT_CONFIG\Software\Microsoft\
windows\CurrentVersion\Internet Settings
ProxyEnable = 1

(Note: The default value data of the said registry entry is 0.)

Dropping Routine

This backdoor drops the following files:

• %Application Data%\Microsoft\stor.cfg - non-malicious file

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Windows\Profiles\{user name}\Application Data on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Application Data on Windows NT, and C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, XP, and Server 2003.)

Download Routine

This backdoor connects to the following malicious URLs:

• • http://{BLOCKED}evideochanel.com
  • http://{BLOCKED}onitoringservice.com
  • http://{BLOCKED}udiodevice.com
  • http://{BLOCKED}fectivecasino.com
  • http://{BLOCKED}.com

It saves the files it downloads using the following names:

• %User Temp%\dwm.exe
• %Application Data%\Microsoft\svchost.exe
• %Application Data%\Microsoft\Windows\shell.exe

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003.. %Application Data% is the current user's Application Data folder, which is usually C:\Windows\Profiles\{user name}\Application Data on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Application Data on Windows NT, and C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, XP, and Server 2003.)

It then executes the downloaded files. As a result, malicious routines of the downloaded files are exhibited on the affected system.

Other Details

This backdoor does the following:

• Downloads an updated copy of itself or other malicious files from the said servers by sending HTTP GET request. It does this by appending any of the following strings:
  • /im133.jpg?tq={parameter}
  • /im134.jpg?tq={parameter}
  • /im135.jpg?tq={parameter}