BKDR_HACKDOOR.BAU

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This backdoor drops the following non-malicious files:

• %Temp%\system.tmp

(Note: %Temp% is the Windows Temporary folder, which is usually C:\Windows\Temp.)

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• global\systemtime0
• global\systemtime2

Autostart Technique

This backdoor registers as a system service to ensure its automatic execution at every system startup by adding the following registry keys:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services
STAC99 =

Other Details

This backdoor connects to the following possibly malicious URL:

• http://www.{BLOCKED}ac.com