BKDR_INJECT.TP

 Analysis by: Michael Cabel

 PLATFORM:

Windows 2000, Windows XP, Windows Server 2003

 OVERALL RISK RATING:
 DAMAGE POTENTIAL:
 DISTRIBUTION POTENTIAL:
 REPORTED INFECTION:

  • Threat Type: Backdoor

  • Destructiveness: No

  • Encrypted: No

  • In the wild: Yes

  OVERVIEW

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

  TECHNICAL DETAILS

File Size:

10,563,072 bytes

File Type:

DLL

Memory Resident:

Yes

Initial Samples Received Date:

13 Jul 2011

Arrival Details

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This backdoor adds the following folders:

  • %Program Files%\Wbod

(Note: %Program Files% is the default Program Files folder, usually C:\Program Files.)

Autostart Technique

This backdoor registers itself as a system service to ensure its automatic execution at every system startup by adding the following registry entries:

HKEY_LOCAL_MACHINE\SOFTWARE\{Random Numbers1}\
Parameters
ServiceDll = "%Program Files%\Wbod\Xkrlgrlng.pic"

HKEY_LOCAL_MACHINE\SOFTWARE\{Random Numbers2}\
Parameters
ServiceDll = "%Program Files%\Wbod\Xkrlgrlng.pic"

HKEY_LOCAL_MACHINE\SOFTWARE\{Random Numbers3}\
Parameters
ServiceDll = "%Program Files%\Wbod\Xkrlgrlng.pic"

HKEY_LOCAL_MACHINE\SOFTWARE\{Random Numbers4}\
Parameters
ServiceDll = "%Program Files%\Wbod\Xkrlgrlng.pic"

HKEY_LOCAL_MACHINE\SOFTWARE\{Random Numbers5}\
Parameters
ServiceDll = "%Program Files%\Wbod\Xkrlgrlng.pic"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\Gieiab Prtvqoqt Bgj\Parameters
ServiceDll = "%Program Files%\Wbod\Xkrlgrlng.pic"

Other System Modifications

This backdoor modifies the following registry key(s)/entry(ies) as part of its installation routine:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\SvcHost
imgsvc = "StiSvc Gieiab Prtvqoqt Bgj"

(Note: The default value data of the said registry entry is StiSvc.)

Dropping Routine

This backdoor drops the following files:

  • %Program Files%\Wbod\Xkrlgrlng.pic - also detected as BKDR_INJECT.TP

(Note: %Program Files% is the default Program Files folder, usually C:\Program Files.)