BKDR_IRCBOT.AYN

This backdoor may be dropped by other malware.

It executes commands from a remote malicious user, effectively compromising the affected system. However, as of this writing, the said sites are inaccessible.

Arrival Details

This backdoor may be dropped by other malware.

Installation

This backdoor drops the following component file(s):

• %System%\{random name}.dll - also detected as BKDR_IRCBOT.AYN
• {malware path}\RunCmd.log - log file
• {malware path}\Temp\114719_507_AhnlabUpdatekit\AhnlabUpdate.exe - also detected as BKDR_IRCBOT.AYN
• {malware path}\Temp\114719_507_AhnlabUpdatekit\RunCmd.exe - also detected as BKDR_IRCBOT.AYN
• {malware path}\Temp\114719_507_AhnlabUpdatekit\RunCmd.ini - configuration file

(Note: %System% is the Windows system folder, which is usually C:\Windows\System32.)

It creates the following folders:

• {malware path}\Temp
• {malware path}\Temp\114719_507_AhnlabUpdatekit

It injects itself into the following processes as part of its memory residency routine:

• explorer.exe
• svchost.exe

Autostart Technique

This backdoor registers itself as a system service to ensure its automatic execution at every system startup by adding the following registry entries:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\{random service name}
DisplayName = "{random service name}"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\{random service name}
ErrorControl = "1"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\{random service name}
ImagePath = "%SystemRoot%\System32\svchost.exe -k netsvcs"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\{random service name}
ObjectName = "LocalSystem"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\{random service name}
Start = "2"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\{random service name}
Type = "20"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\{random service name}\Parameters
ServiceDll = "%System%\{random name}.dll"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\{random service name}\Parameters
ServiceMain = "ServiceMain"

Other System Modifications

This backdoor adds the following registry keys:

HKEY_CLASSES_ROOT\Msxml2.DOMDocument.3.7

HKEY_CLASSES_ROOT\Msxml2.DOMDocument.3.7\CLSID

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Microsoft Sign

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\{random service name}

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\{random service name}\Enum

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\{random service name}\Parameters

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\{random service name}\Security

It adds the following registry entries:

HKEY_CLASSES_ROOT\Msxml2.DOMDocument.3.7\CLSID
(Default) = "{88d96a05-f192-11d4-a65f-0040963251e5}"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Microsoft Sign
KeyCode = "{random values}"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Microsoft Sign
Policy = "{random values}"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Microsoft Sign
SignCode = "{random values}"

It modifies the following registry entries:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\SvcHost
netsvcs = "{default values} {random service name}"

(Note: The default value data of the said registry entry is {default values}.)

Backdoor Routine

This backdoor executes the following commands from a remote malicious user:

• Get operating system information
• Get drive information
• Get computer name
• Get user name
• Join an IRC channel to get commands
• Enumerate files and folders
• Create files and folders
• Download files
• Perform remote shell
• Sleep for a specified amount of time
• Restart system
• Terminate self
• Update self

It connects to the following URL(s) to send and receive commands from a remote malicious user:

• http://{BLOCKED}a.cine21.com/bbs/icon/install1_ok.php
• http://{BLOCKED}g.pe.kr/mdk/install1_ok.php
• http://{BLOCKED}hairstory.com.au/bbs/install_ok.php
• http://{BLOCKED}r.pe.kr/zeroboard/install1_ok.php

However, as of this writing, the said sites are inaccessible.

NOTES:
It checks if the date is less than January 1, 2002. If it is, the malware remains dormant for a day then performs another date check. It does this until the date is greater than or equal to January 1, 2002.