BKDR_GUOQA.A

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It runs certain commands that it receives remotely from a malicious user. Doing this puts the affected computer and information found on the computer at greater risk. It connects to a website to send and receive information.

It retrieves specific information from the affected system.

Arrival Details

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This backdoor drops the following component file(s):

• %Program Files%\Windows NT\htrn.dll - also detected as BKDR_GUOQA.A

(Note: %Program Files% is the default Program Files folder, usually C:\Program Files.)

Its DLL component is injected to the following process(es):

• svchost.exe

Autostart Technique

This backdoor registers itself as a system service to ensure its automatic execution at every system startup by adding the following registry entries:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\6to4\Parameters
ServiceDll = %Program Files%\Windows NT\htrn.dll

Backdoor Routine

This backdoor opens the following port(s) where it listens for remote commands:

• 443

It executes the following command(s) from a remote malicious user:

• List running processes
• Terminate process
• Download and execute file
• Open a remote command shell access
• Write to a file
• Uninstall itself
• Reboot the system

It connects to the following websites to send and receive information:

• snrp.{BLOCKED}s.com

Information Theft

This backdoor retrieves the following information from the affected system:

• Computer name
• Local IP address
• Service pack