BKDR_PROXY.BEIR

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. It arrives as a component bundled with malware/grayware packages.

It does not have any propagation routine.

It executes commands from a remote malicious user, effectively compromising the affected system.

As of this writing, the said sites are inaccessible.

Arrival Details

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It arrives as a component bundled with malware/grayware packages.

Propagation

This backdoor does not have any propagation routine.

Backdoor Routine

This backdoor executes the following commands from a remote malicious user:

• Execute files
• Perform remote shell
• Sleep for a specified amount of time
• Download files
• Delete self

It connects to the following URL(s) to send and receive commands from a remote malicious user:

• http://{BLOCKED}d.{BLOCKED}c.or.kr/UploadFile/fame/x/o0.asp?id=flag:java%20host:{Host Name}%20IP:{IP Address}%20OS:{OS Version}%20vm:{special character}%20proxy:{special character}

Download Routine

This backdoor accesses the following websites to download files:

• http://{BLOCKED}.{BLOCKED}u.com/a.asp?id={random value}{Day, Date, Time and Year of Download}
• http://{BLOCKED}.{BLOCKED}u.com/b.asp?id={random value}{Day, Date, Time and Year of Download}
• http://{BLOCKED}java.{BLOCKED}4.com/a.asp?id={random value}{Day, Date, Time and Year of Download}
• http://{BLOCKED}ava.{BLOCKED}4.com/b.asp?id={random value}{Day, Date, Time and Year of Download}

It saves the files it downloads using the following names:

• %User Temp%\temp.ini

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.)

As of this writing, the said sites are inaccessible.

Information Theft

This backdoor gathers the following data:

• Proxy Server IP and Port
• Host Name
• Local IP Address
• OS Version

NOTES:

It does not have rootkit capabilities.

It does not exploit any vulnerability.