BKDR_POISON.BKK

This backdoor arrives as an attachment to email messages spammed by other malware/grayware or malicious users. It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It does not have any propagation routine.

It does not have any downloading capability.

Arrival Details

This backdoor arrives as an attachment to email messages spammed by other malware/grayware or malicious users.

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This backdoor adds the following mutexes to ensure that only one of its copies runs at any one time:

• ((*HKG^%3

Autostart Technique

This backdoor adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Active Setup\Installed Components\{GUID}
StubPath = "{malware path and filename}"

Propagation

This backdoor does not have any propagation routine.

Backdoor Routine

This backdoor opens the following port(s) where it listens for remote commands:

• TCP port 443

It connects to the following URL(s) to send and receive commands from a remote malicious user:

• jj.{BLOCKED}ndarydns.com

Download Routine

This backdoor does not have any downloading capability.

Other Details

Based on analysis of the codes, it has the following capabilities:

• Capture screen, audio, and webcam
• Log keystrokes
• List active ports
• Manage open windows
• Manage passwords
• Manage registry, processes, services, devices, and installed applications
• Perform multiple simultaneous transfers
• Perform remote shell
• Relay server
• Search files
• Share servers
• Update, restart, terminates itself

NOTES:

This backdoor does not have rootkit capabilities.

This backdoor does not exploit any vulnerability.