BKDR_LUMINOSITY.Q

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes commands from a remote malicious user, effectively compromising the affected system.

It connects to certain websites to send and receive information.

Arrival Details

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This backdoor drops the following copies of itself into the affected system:

• %User Temp%\videobuffer.exe

(Note: %User Temp% is the user's temporary folder, where it usually is C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local\Temp on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

Autostart Technique

This backdoor adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
(Default) = "%User Temp%\videobuffer.exe"

Backdoor Routine

This backdoor executes the following commands from a remote malicious user:

• Downloads and executes arbitrary files
• Downloads and executes custom Crypto Miner
• Downloads custom password recovery tool
• Searches for files
• Performs DDOS
• Modifies HOSTS file to redirect hosts/URLs
• Visits arbitrary websites (browser can be hidden and have muted audio)
• Seeds torrent
• Updates itself
• Updates backup C&C
• Remotes Desktop Control
• Remotes shell
• Remotes Script
• Records audio using system's microphone
• Controls Webcam
• Uninstalls itself
• Executes/Terminates/Disables Task Manager
• Executes/Terminates/Disables Command Prompt
• Executes/Terminates/Disables Registry Editor
• Hides/Shows Taskbar
• Hides/Shows Desktop
• Opens/Closes CD-ROM door
• Turns on/off user's monitor
• Enables/Disables Keyboard
• Enables/Disables Mouse
• Swaps/Resets Mouse
• Deletes Restore points
• Enables/Disables input
• Logs off User
• Hibernates
• Shutdowns system
• Reboots System
• Performs network speed test
• Manage Files
• Manage Processes
• Gathers the following information:
  • Client Overview:
    • Client ID used
    • Country
  • Software Information:
    • User Privelege
    • Machine Name
  • Hardware Information:
    • Machine Type
    • CPU Information
    • GPU Information
    • RAM Information
    • Battery
    • Monitor Count
  • Network Information:
    • WAN address
    • Download Speed
    • LAN Address
    • MAC Address
  • Others:
    • Security information
    • Uptime
    • Active Windows
    • Current malware file location
    • Full OS version
    • Keystroke logs
    • Stored passwords

Other Details

This backdoor connects to the following website to send and receive information:

• {BLOCKED}si.chickenkiller.com

It does the following:

• It proactively blocks Anti-malware services by querying the installed Anti-Malware/Firewall product in the system. Once an anti-malware/firewall is found, it terminates the corresponding Anti-malware service/process.