BKDR_EMOGEN.YHB

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It does not have any propagation routine.

It executes commands from a remote malicious user, effectively compromising the affected system.

Arrival Details

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This backdoor drops the following non-malicious files:

• %User Temp%\~numk217{random number}.tmp

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.)

Propagation

This backdoor does not have any propagation routine.

Backdoor Routine

This backdoor executes the following commands from a remote malicious user:

• Download end execute arbitrary files
• Perform remote shell commands
• Start and terminate processes and threads
• Enumerate files
• Get operating system configuration, security information, product ID, and hardware properties, such as RAM, disk space, and network cards
• Delete NTLDR
• Shut down the computer

It connects to the following URL(s) to send and receive commands from a remote malicious user:

• {BLOCKED}.{BLOCKED}.87.26:443/b?P={generated value}
• {BLOCKED}.{BLOCKED}.4.78:443/b?P={generated value}

As of this writing, the said sites are inaccessible.

Download Routine

This backdoor accesses the following websites to download files:

• http://blogs.{BLOCKED}o.co.jp/sukuzi2012008/9695716.html
• http://blogs.{BLOCKED}o.co.jp/komatsu20120809/37508778.html

It saves the files it downloads using the following names:

• %User Temp%\index~k{random number}.htm - contains the address of the C&C server

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.)

Information Theft

This backdoor gathers the following data:

• Computer name
• Drive type
• Operating system and version
• Language