BKDR_TUBS.A

This backdoor may be dropped by other malware.

It executes commands from a remote malicious user, effectively compromising the affected system.

It logs a user's keystrokes to steal information.

It deletes the initially executed copy of itself.

Arrival Details

This backdoor may be dropped by the following malware:

• TROJ_MDROP.JY

Installation

This backdoor drops the following files:

• %Windows%\fxsst.dll - also detected as BKDR_TUBS.A
• %System%\Ezcob.dll - also detected as BKDR_TUBS.A
• All Users' %User Profile%\Application Data\Windows NT\config.dat - encrypted DLL file
• All Users' %User Profile%\Application Data\Windows NT\wp.dat
• All Users' %User Profile%\Application Data\Windows NT\NtHelpIndex.bak - downloaded code stub
• All Users' %User Profile%\Application Data\Windows NT\NtHelpKey.bak - downloaded code stub
• All Users' %User Profile%\Application Data\Windows NT\Support\{random number}.jj – downloaded code stub
• All Users' %User Profile%\Application Data\Windows NT\Support\{random number}.kb - logged keystrokes and active window

(Note: %Windows% is the Windows folder, which is usually C:\Windows or C:\WINNT.. %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.. %User Profile% is the current user's profile folder, which is usually C:\Windows\Profiles\{user name} on Windows 98 and ME, C:\WINNT\Profiles\{user name} on Windows NT, and C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003.)

It adds the following processes:

• explorer.exe

Its DLL component is injected to the following process(es):

• explorer.exe

It creates the following folders:

• All Users' %User Profile%\Application Data\Windows NT
• All Users' %User Profile%\Application Data\Windows NT\Support

(Note: %User Profile% is the current user's profile folder, which is usually C:\Windows\Profiles\{user name} on Windows 98 and ME, C:\WINNT\Profiles\{user name} on Windows NT, and C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003.)

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• Global\Ezcob
• Global\@`{

Autostart Technique

This backdoor registers itself as a system service to ensure its automatic execution at every system startup by adding the following registry entries:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\Ezcob
DisplayName = "Ezcob"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\Ezcob
ErrorControl = "1"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\Ezcob
ImagePath = "%SystemRoot%\System32\svchost.exe -k netsvcs"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\Ezcob
ObjectName = "LocalSystem"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\Ezcob
Start = "2"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\Ezcob
Type = "120"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\Ezcob\Parameters
ServiceDll = "%System%\Ezcob.dll"

Other System Modifications

This backdoor adds the following registry keys:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\Ezcob

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\Ezcob\Enum

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\Ezcob\Parameters

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\Ezcob\Security

It modifies the following registry entries:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\SvcHost
netsvcs = "{Default values} Ezcob"

(Note: The default value data of the said registry entry is {Default values} .)

Backdoor Routine

This backdoor executes the following commands from a remote malicious user:

• Download and execute file from server
• Download code stub from server
• Activate code stub
• Deactivate code stub

It connects to the following URL(s) to send and receive commands from a remote malicious user:

• www.{BLOCKED}jiaozihaha.net

Information Theft

This backdoor logs a user's keystrokes to steal information.

Other Details

This backdoor connects to the following URL(s) to check for an Internet connection:

• 1.{BLOCKED}st.{BLOCKED}22.org.cn
• 2.{BLOCKED}st.{BLOCKED}22.org.cn
• 3.{BLOCKED}st.{BLOCKED}22.org.cn
• 4.{BLOCKED}st.{BLOCKED}22.org.cn

It deletes the initially executed copy of itself

NOTES:

The malicious file %Windows%\fxsst.dll is loaded by explorer.exe every system startup instead of the legitimate file %System%\fxsst.dll.

This backdoor loads %All Users Profile%\Application Data\Windows NT\config.dat and decrypts it in memory in order to perform its backdoor routines.

This backdoor checks for the existence of the following processes:

• 360safe.exe
• KSafeSvc
• KVSrvXP.exe
• avguard.exe
• avp.exe
• ccsvchst
• ekrn.exe
• ravmond
• sfctlcom
• twister
• vsmon

If one of these processes is found, it will rename the dropped DLL file to one of the following names to avoid detection:

• %Windows%\msacm32.drv
• %Windows%\mydocs.dll
• %Windows%\samlib.dll

The renamed file is also loaded by explorer.exe every system startup instead of the legitimate file with the same name.