BKDR_NAPOLAR.FS

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It is injected into all running processes to remain memory resident.

It executes commands from a remote malicious user, effectively compromising the affected system. It connects to a website to send and receive information.

Arrival Details

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This backdoor drops the following copies of itself into the affected system and executes them:

• %User Startup%\lsass.exe

(Note: %User Startup% is the current user's Startup folder, which is usually C:\Windows\Profiles\{user name}\Start Menu\Programs\Startup on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Start Menu\Programs\Startup on Windows NT, and C:\Documents and Settings\{User name}\Start Menu\Programs\Startup.)

It is injected into all running processes to remain memory resident.

Autostart Technique

This backdoor drops the following file(s) in the Windows User Startup folder to enable its automatic execution at every system startup:

• %User Startup%\lsass.exe

(Note: %User Startup% is the current user's Startup folder, which is usually C:\Windows\Profiles\{user name}\Start Menu\Programs\Startup on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Start Menu\Programs\Startup on Windows NT, and C:\Documents and Settings\{User name}\Start Menu\Programs\Startup.)

Backdoor Routine

This backdoor executes the following commands from a remote malicious user:

• Steal information from a browser
• Open a browser and load a specific page
• Run a Tor service
• Download and execute file
• Perform DDOS attack

It connects to the following websites to send and receive information:

• http://www.{BLOCKED}answorld.in/index/user/forum/talks/

Information Theft

This backdoor gathers the following data:

• User name
• Computer name

NOTES:

This backdoor creates the following named pipe:

• \\.\pipe\napSolar

It can run a Tor service by dropping the following files:

• %Application Data%\tor.bin
• %Application Data%\torrc

It can also hook APIs.

With its rootkit functionality, it can block changes to the following registry keys:

• Microsoft\Windows\CurrentVersion\Run
• Microsoft\Windows NT\CurrentVersion\Windows\run
• Microsoft\Windows NT\CurrentVersion\Windows\load
• Microsoft\Windows\CurrentVersion\Policies\Explorer\run
• Microsoft\Windows NT\CurrentVersion\Winlogon
• Microsoft\Active Setup\Installed Components