BKDR_NFLOG.XC

This backdoor executes commands from a remote malicious user, effectively compromising the affected system.

Arrival Details

This backdoor may be downloaded from the following remote sites:

• http://www.{BLOCKED}s.com/NfLog/Nfile.asp

Autostart Technique

This backdoor registers itself as a system service to ensure its automatic execution at every system startup by adding the following registry entries:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\IPRIP
Type = 20

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\IPRIP
Start = 2

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\IPRIP
ErrorControl = 1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\IPRIP
ImagePath = %SystemRoot%\System32\svchost.exe -k netsvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\IPRIP
DisplayName = "IPv6 Stack Local Support"c

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\IPRIP
ObjectName = "LocalSystem"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\IPRIP
Description = "Net address translation for IPv6 Protocol"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\IPRIP\Parameters
ServiceDll = {Malware Path and File Name}

Other System Modifications

This backdoor adds the following registry entries:

HKEY_CURRENT_USER\Software\Microsoft\
Clock
HID = "{hex values}"

Backdoor Routine

This backdoor executes the following commands from a remote malicious user:

• Download files
• Perform remote shell
• Retrieve system information
• Update self

It connects to the following URL(s) to send and receive commands from a remote malicious user:

• http://www.{BLOCKED}s.com/NfLog/Nfile.asp
• http://www.{BLOCKED}s.com/NfLog/TTip.asp
• http://www.{BLOCKED}s.com/NfLog/NfStart.asp
• http://www.{BLOCKED}s.com/NfLog/NfHostInfo.asp
• http://www.{BLOCKED}s.com/NfLog/NfCommand.asp
• http://www.{BLOCKED}s.com/NfLog/Nfpredown.asp
• http://www.{BLOCKED}s.com/NfLog/NfUpda.asp

It posts the following information to its command and control (C&C) server:

• IP configuration
• Network statistics
• Running processes
• Running services
• System information
• List of files from the folder %userprofile%\recent\

Stolen Information

This backdoor saves the stolen information in the following file:

• %Temp%\$NtUninstallKB942388$

(Note: %Temp% is the Windows Temporary folder, which is usually C:\Windows\Temp or C:\WINNT\Temp.)

NOTES:

It reports system infection by sending IP address and infection time to the following URL via HTTP post:

• http://www.{BLOCKED}s.com/NfLog/NfStart.asp