BKDR_NEUTRINO.NM

This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes commands from a remote malicious user, effectively compromising the affected system. It connects to a website to send and receive information.

Arrival Details

This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Backdoor drops the following copies of itself into the affected system and executes them:

• %Application Data%\OWZCEN323F\{random file name}.exe

(Note: %Application Data% is the Application Data folder, where it usually is C:\Documents and Settings\{user name}\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Roaming on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

It creates the following folders:

• %Application Data%\OWZCEN323F

(Note: %Application Data% is the Application Data folder, where it usually is C:\Documents and Settings\{user name}\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Roaming on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

Autostart Technique

This Backdoor adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
{random file name}.exe = "%Application Data%\OWZCEN323F\{random file name}.exe"

Other System Modifications

This Backdoor adds the following registry keys:

HKEY_CURRENT_USER\Software\N3NNetwork

It adds the following registry entries:

HKEY_CURRENT_USER\Software\N3NNetwork
arr = "{random}="

HKEY_CURRENT_USER\Software\N3NNetwork
{random digits 1} = "0"

HKEY_CURRENT_USER\Software\N3NNetwork
{random digits 2} = "0"

HKEY_CURRENT_USER\Software\N3NNetwork
{random digits 3} = "0"

HKEY_CURRENT_USER\Software\N3NNetwork
{random digits 4} = "0"

HKEY_CURRENT_USER\Software\N3NNetwork
{random digits 5} = "0"

HKEY_CURRENT_USER\Software\N3NNetwork
rate = "5"

Backdoor Routine

This Backdoor executes the following commands from a remote malicious user:

• Loads arbitrary file
• Find files
• Spread through removable drives
• Infect .RAR files
• Perform flood attacks (HTTP, SLOWLORIS, DOWNLOAD, TCP, UDP, SMART, HTTPS)
• Start keylogging routine
• Update itself
• Uninstall itself
• Perform remote shell
• Modify hosts file

It connects to the following websites to send and receive information:

• http://{BLOCKED}k-shop.cf/bp/tasks.php

Information Theft

This Backdoor gathers the following data:

• User ID
• OS Version
• AV software installed
• NAT installed
• Product key

NOTES:

This backdoor checks for the following:

• Debugger
• COMPUTER NAME contains the following strings:
  • MALTEST
  • TEQUILABOOMBOOM
  • SANDBOX
  • VIRUS
  • MALWARE
• Path of the file contains the following strings:
  • \SAMPLE
  • \VIRUS
  • SANDBOX
• If kernel32.dll exports the function wine_get_unix_file_name
• Loaded libraries:
  • sbiedll.dll
  • printfhelp.dll
  • api_log.dll
  • dir_watch.dll
  • pstorec.dll
  • vmcheck.dll
  • wpespy.dll
• If any of the following registries are present:
  • HKEY_LOCAL_MACHINE\SOFTWARE\VMWare, Inc.\VMare Tools
  • HKEY_LOCAL_MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions
• If the value of the following registry entries contains the strings VBOX, VIRTUALBOX, QEMU, VMWARE:
  • HKEY_LOCAL_MACHINE\HARDWARE\DEVICEMAP\Scsi\Scsi Port 0\Scsi Bus 0\Target Id 0\Logical Unit Id 0\Identifier
  • HKEY_LOCAL_MACHINE\HARDWARE\Description\System\SystemBiosVersion
  • HKEY_LOCAL_MACHINE\HARDWARE\Description\System\VideoBiosVersion

If any of the conditions is met, it terminates itself and displays an error message.