BKDR_DARKMOON.SM1

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It does not have any propagation routine.

It connects to a website to send and receive information.

Arrival Details

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This backdoor drops the following files:

• %User Temp%\~TX{number}.TMP - also detected as BKDR_DARKMOON.SM1

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003.)

It drops the following non-malicious file:

• %Current%\{malware filename}.pdf

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• *^%fahk)F

It stays memory-resident by injecting codes into the following processes:

• explorer.exe

Other System Modifications

This backdoor adds the following registry entries:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Active Setup\Installed Components\{6B808548-D083-A635-C7BB-B37E45A98DE7}
StubPath = "C:\Windows\system32:ctfmonn.exe"

It adds the following registry keys as part of its installation routine:

HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\
\Settings

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Active Setup\Installed Components\{6B808548-D083-A635-C7BB-B37E45A98DE7}

HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\
\Recent File List

Propagation

This backdoor does not have any propagation routine.

Backdoor Routine

This backdoor connects to the following websites to send and receive information:

• http://{BLOCKED}dns.{BLOCKED}ns-blog.com
• 1j.{BLOCKED}w1.biz

NOTES:

It queries the default web browser by accessing the following registry entry:

HKEY_CLASSES_ROOT\http\shell\open\command

It then launches a hidden Web browser process (e.g. iexplore.exe) where this malware injects its code for its backdoor routines.

This backdoor has the following capabilities:

• Capture screen shots, webcam, audio
• Delete, search, and upload files
• Download and inject remote codes to legitimate processes
• Log keystrokes and active window
• Manage processes and services
• Modify and search the registry entries
• Perform a shell command
• Send system information (IP address, computer name, user name, operating system)
• Update/Uninstall the malware
• View and terminate active windows and ports

This backdoor does not have rootkit capabilities.

This backdoor does not exploit any vulnerability.