BKDR_ZURGOP.A

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes commands from a remote malicious user, effectively compromising the affected system. It connects to a website to send and receive information.

Arrival Details

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This backdoor drops the following copies of itself into the affected system:

• %Application Data%\{random}\{random}.exe

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.)

It adds the following processes:

• svchost.exe

It creates the following folders:

• %Application Data%\{random}

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.)

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• {Generated Sha1 Hash}

Autostart Technique

This backdoor adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
Explorer\Run
{Random Installed Application Name} = %Application Data%\{random}\{random}.exe

Backdoor Routine

This backdoor executes the following commands from a remote malicious user:

• Download and execute arbitrary files (Plugins)
• Update Itself

It connects to the following websites to send and receive information:

• http://{BLOCKED}ismcanarium.ru/index.php
• http://{BLOCKED}wight.ru/index.php

Information Theft

This backdoor gathers the following data:

• Auto-run Registries
• Installed Applications
• OS Version
• Volume Information

NOTES:
Running Conditions:

Filename is not equal to:

• Sample

No Virtualization Used (based on registries):

• Qemu (Quick Emulator)
• VMware (VMWare)
• Virtual (VirtualBox)

No Loaded Modules:

• dbghelp (OllyDbg)
• sbiedll (SandBox)