BKDR_POSTBOT.ER

It did not exhibit information theft routines during testing. It has no rootkit capabilities.

It executes commands from a remote malicious user, effectively compromising the affected system.

This backdoor may be downloaded by other malware/grayware/spyware from remote sites. It may be unknowingly downloaded by a user while visiting malicious websites.

Arrival Details

This backdoor may be downloaded by other malware/grayware/spyware from remote sites.

It may be unknowingly downloaded by a user while visiting malicious websites.

Installation

This backdoor adds the following mutexes to ensure that only one of its copies runs at any one time:

• siueu2dowg

Other System Modifications

This backdoor adds the following registry keys:

HKEY_LOCAL_MACHINE\tmp123

It adds the following registry entries as part of its installation routine:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer
MMID = {hex values}

Download Routine

This backdoor saves the files it downloads using the following names:

• %System%\svch0st.exe

(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.)

NOTES:

Backdoor Routine

This Backdoor executes the following commands from a remote malicious user:

• Connects to another URL
• Downloads other files
• Executes a file named %System%\svch0st.exe with the /u parameter
• Execute a file named %System%\svch0st.exe with the /g parameter
• Executes arbitrary CMD.EXE shell commands
• Enumerates all drives and acquires drive information
• Creates a new directory
• Creates a process
• Terminates processes

(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.)

It connects to the following URL(s) to send and receive commands from a remote malicious user:

• {host name}\{random alphanumeric characters}{hard-coded string}.php

The host name can be any of the following:

• newz.{BLOCKED}eck.org
• {BLOCKED}te.nameserver.ns2.name

The hard-coded string can be any of the following:

• lkwoeg.php
• qowgmh.php
• nlwghg.php
• adowhg.php
• zjfohh.php
• whgohy.php
• shoheg.php
• xoghgh.php
• eoirhh.php
• dhbgbb.php
• gheowt.php
• chtgot.php
• rthghh.php
• fbhbbt.php
• vhgbgw.php
• thgowe.php
• wehowe.php
• yhhbwe.php
• ndsewt.php
• klgewo.php

As of this writing, the said sites are inaccessible.