BKDR_LINEAGE.EWD

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This backdoor creates the following folders:

• %User Temp%\E_N4
• %Program Files%\gqven

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003.. %Program Files% is the default Program Files folder, usually C:\Program Files.)

Other System Modifications

This backdoor deletes the following files:

• %User Temp%\nsv1.tmp
• %Windows%\fonts\msgothic.ttf
• %Windows%\fonts\msuigoth.ttf
• %Windows%\fonts\MSMINCHO.TTF
• %Windows%\fonts\Gulim.ttf
• %Windows%\fonts\Gulimche.ttf
• %Windows%\fonts\Dotum.ttf
• %Windows%\fonts\Batang.ttf
• %Windows%\fonts\Gungsuh.ttf
• %Windows%\fonts\Simsun.ttf
• %Windows%\fonts\nsimsun.ttf
• %Windows%\fonts\MingLiU.ttf
• %Windows%\fonts\pmingliu.ttf
• %System%\SET3.tmp
• %System%\kbd101b.dll
• %System%\SET5.tmp
• %System%\kbd101c.dll
• %System%\SET7.tmp
• %System%\kbd103.dll
• %System%\SET9.tmp
• %System%\kbd106.dll
• %System%\SETB.tmp
• %System%\kbdjpn.dll
• %System%\SETD.tmp
• %System%\kbdkor.dll
• %System%\642d3b30.del
• %Program Files%\gqven\gqven.dll
• %System Root%\ruirui.exe
• %Windows%\SoftwareDistribution\DataStore\Logs\edbtmp.log

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003.. %Windows% is the Windows folder, which is usually C:\Windows or C:\WINNT.. %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.. %Program Files% is the default Program Files folder, usually C:\Program Files.. %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.)

It adds the following registry keys:

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\International\CpMRU

HKEY_LOCAL_MACHINE\SOFTWARE\ki6to45

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\MediaResources\msvideo

It adds the following registry entries:

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\International\CpMRU
Enable = "1"

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\International\CpMRU
Size = "a"

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\International\CpMRU
InitHits = "64"

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\International\CpMRU
Factor = "14"

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\International
W2KLpk = "1"

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\International
W2KLpk = "0"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\6to4
Module = "%System Root%\ruirui.exe"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\6to4\Parameters
ServiceMain = "CAGetDN"

It modifies the following registry entries:

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\6to4
Description = "{random characters}"

(Note: The default value data of the said registry entry is Provides DDNS name registration and automatic IPv6 connectivity over an IPv4 network. If this service is stopped, other computers may not be able to reach it by name and the machine will only have IPv6 connectivity if it is connected to a native IPv6 network. If this service is disabled, any other services that explicitly depend on this service will fail to start..)

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\6to4\Parameters
ServiceDll = "%Program Files%\gqven\gqven.dll"

(Note: The default value data of the said registry entry is {random values}.)

Dropping Routine

This backdoor drops the following files:

• \lanren.exe
• \ruirui.exe
• %User Temp%\E_N4\krnln.fnr
• %User Temp%\E_N4\iext.fnr
• %User Temp%\E_N4\eNetIntercept.fne
• %User Temp%\E_N4\shell.fne
• %User Temp%\E_N4\eAPI.fne
• %User Temp%\E_N4\internet.fne
• %User Temp%\E_N4\shellEx.fne
• %User Temp%\E_N4\HtmlView.fne
• %User Temp%\E_N4\dp1.fne
• %User Temp%\E_N4\PBShell.fne
• %User Temp%\E_N4\downlib.fne
• %System%\SkinH_EL.dll
• %User Temp%\longhorn.she
• %System%\SET2.tmp
• %System%\SET4.tmp
• %System%\SET6.tmp
• %System%\SET8.tmp
• %System%\SETA.tmp
• %System%\SETC.tmp
• %User Temp%\62875.log
• %System%\SET3.tmp
• %System%\SET5.tmp
• %System%\SET7.tmp
• %System%\SET9.tmp
• %System%\SETB.tmp
• %System%\SETD.tmp

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003.. %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.)

Other Details

This backdoor connects to the following possibly malicious URL:

• http://www.{BLOCKED}u.com
• http://www1.{BLOCKED}f.cn/upgrate5.txt
• http://www1.{BLOCKED}f.cn/new.txt
• http://www1.{BLOCKED}f.cn/wlbt.txt

This report is generated via an automated analysis system.