Backdoor.Win32.BIFROSE.AD

This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It does not have any propagation routine.

It executes commands from a remote malicious user, effectively compromising the affected system.

It steals certain information from the system and/or the user. It logs a user's keystrokes to steal information.

Arrival Details

This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Backdoor drops the following files:

• %User Temp%\win9809.dat -> encrypted file containing keylogged data

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

Propagation

This Backdoor does not have any propagation routine.

Backdoor Routine

This Backdoor executes the following commands from a remote malicious user:

• Get Idle Time
• Upload contents of %User Temp%\win9809.dat containing encrypted keylogger-related logs
• Delete %User Temp%\win9809.dat
• Gather Drives' (A-Z) Information
• Find File
• Create Component file %User Temp%\werfc0908.dat
• Write to Component file %User Temp%\werfc0908.dat
• Upload File
• Create Process
• Create Directory
• Delete File
• Delete Directory
• Execute Command using ShellExecute
• Rename File
• Enumerate all Windows' Names
• Set foreground window
• Hide Window
• Change a window's Title Bar
• Send input/keystrokes to window
• Take Screenshot
• Get Current Display Resolution
• Send Mouse Input
• Get Processes' File Name
• Terminate Process
• Uninstall Self
• Read Data from Pipe Connection
• Write to File

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It connects to the following URL(s) to send and receive commands from a remote malicious user:

• http://{BLOCKED}.{BLOCKED}.92.110:443

As of this writing, the said sites are inaccessible.

Rootkit Capabilities

This Backdoor does not have rootkit capabilities.

Download Routine

This Backdoor saves the files it downloads using the following names:

• %User Temp%\werfc0908.dat -> encrypted component file loaded by the malware. Detected as Trojan.Win32.BIFROSE.AA

Information Theft

This Backdoor steals the following information:

• Computer Name
• User Name
• IPv4 Address
• Current Process ID
• Volume Information
• Locale Info
• Keyboard Layout Name
• If %User Temp%\werfc0908.dat is loaded, passwords/credentials for the following:
  • Passport.net
  • MSN Messenger
  • Messenger Service
  • Mirabilis ICQ
  • Mozilla Firefox Signons and User Profiles
  • Cached Passwords (Windows for Workgroups)
• Folder Paths of the following:
  • %Application Data%\Microsoft\Windows\Recent
  • %Desktop%
  • %User Profile%\Documents

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name} on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It logs a user's keystrokes to steal information.

It checks for the presence of the following processes:

• Will not proceed to connection when the following process substrings are found running:
  • TCPVIEW
  • ICESWORD
  • CPORT
  • WIRESHARK
  • NETSTAT
  • ETHERAL

Other Details

This Backdoor does not exploit any vulnerability.

NOTES:

It uses proxy connections by connecting to the following website(s):

Proxy servers gathered from the following registry entries where protocol "HTTP" is used:

• In HKEY_USERS\{User SID}\Software\Microsoft\Windows\CurrentVersion\Internet Settings
  • ProxyServer = "{server name}"