BKDR_POISON.BQG

This backdoor arrives as an attachment to email messages spammed by other malware/grayware or malicious users. It may be dropped by other malware.

It executes commands from a remote malicious user, effectively compromising the affected system. It connects to a website to send and receive information.

Arrival Details

This backdoor arrives as an attachment to email messages spammed by other malware/grayware or malicious users.

It may be dropped by other malware.

Installation

This backdoor drops the following copies of itself into the affected system:

• %Application Data%\conime.exe

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.)

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• !*YGA.14

Backdoor Routine

This backdoor executes the following commands from a remote malicious user:

• Send system information (Lan IP, Wan IP, Computer name, Username, Account Type, OS)
• Send hardware information (CPU speed, Memory)
• Manage Files (Search, Download, Upload, Execute, Rename, Delete)
• Manage Registries (Search, Modify, Delete, Rename, Create)
• Manage Processes (View, Kill, Suspend, Unload Module)
• Manage Services (View, Start, Stop, Edit, Install, Uninstall)
• Manage Devices (View, Enable, Disable, Remove)
• Manage Windows
• Relay server
• View,copy and uninstall applications
• View active ports
• Perform a shell command
• Download and inject remote codes to legitimate processes
• Log keystrokes and active window
• Capture screenshots
• View webcam activity
• Listen to microphone audio
• Update, Uninstall, Restart the malware
• Retrieve cached passwords and hashes

It connects to the following websites to send and receive information:

• {BLOCKED}oftupdate.{BLOCKED}ser.com