BKDR_NEUREVT.C

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes commands from a remote malicious user, effectively compromising the affected system. It connects to a website to send and receive information.

It modifies the Internet Explorer Zone Settings.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan drops the following copies of itself into the affected system and executes them:

• %Program Files%\Common Files\USB Adapter Updater\{random filename}.exe

(Note: %Program Files% is the Program Files folder, where it usually is C:\Program Files on all Windows operating system versions; C:\Program Files (x86) for 32-bit applications running on Windows 64-bit operating systems.)

It adds the following processes:

• explorer.exe

It injects itself into the following processes as part of its memory residency routine:

• explorer.exe

Autostart Technique

This Trojan adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
USB Adapter Updater = "%Program Files%\Common Files\USB Adapter Updater\{random filename}.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
USB Adapter Updater = "%Program Files%\Common Files\USB Adapter Updater\{random filename}.exe"

Other System Modifications

This Trojan creates the following registry entry(ies) to bypass Windows Firewall:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\AuthorizedApplications\
List
%Windows%\explorer.exe = "%Windows%\explorer.exe:*:Enabled"

Backdoor Routine

This Trojan executes the following commands from a remote malicious user:

• Download and execute files
• Perform Slowloris flooding
• Execute shell commands
• Open a URL
• Uninstall
• Update copy of itself

It connects to the following websites to send and receive information:

• {BLOCKED}acka.com
• {BLOCKED}band.com
• {BLOCKED}obast.com
• {BLOCKED}erda.com
• {BLOCKED}utlol.com
• {BLOCKED}sonsi.com
• {BLOCKED}esa.com
• {BLOCKED}onsor.com
• {BLOCKED}ngsong.com
• {BLOCKED}stion.com

Web Browser Home Page and Search Page Modification

This Trojan modifies the Internet Explorer Zone Settings.

Information Theft

This Trojan gathers the following data:

• System information
• Installed FTP software
• Installed browsers
• Installed anti-malware products
• Other Installed software
  • mIRC
  • Steam
  • 7-zip
  • Nmap
  • Hex-Rays
  • Wireshark
  • Skype
  • VmWare
  • Java version
  • .NET version
  • Perl
  • Minecraft
• OS Version

Other Details

This Trojan does the following:

• It hooks APIs to monitors the activites of the following browsers:
  • firefox.exe
  • iexplore.exe
  • chrome
• It hooks the following APIs:
  • PR_Write
  • HttpSendRequestW
  • GetAddrInfoW
• It disables the following antivirus-related applications by adding the following registry entries:
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\{application}
  Debugger = {random characters}.exe
  where {application} are as follows:
  • a2guard.exe
  • a2service.exe
  • a2start.exe
  • adaware.exe
  • ALUpdate.exe
  • arcaclean.exe
  • avastsvc.exe
  • avastui.exe
  • avcenter.exe
  • AVENGINE.exe
  • avgcfgex.exe
  • avgidsagent.exe
  • avgmfapx.exe
  • avgnt.exe
  • avguard.exe
  • avgui.exe
  • avgupd.exe
  • avgwdsvc.exe
  • AVK.exe
  • AVKTray.exe
  • avshadow.exe
  • BgScan.exe
  • BullGuard.exe
  • BullGuardBhvScanner.exe
  • BullGuardScanner.exe
  • BullGuardUpdate.exe
  • BullGuardUpdate2.exe
  • ccsvchst.exe
  • ccupdate.exe
  • CLPSLA.exe
  • coreFrameworkHost.exe
  • coreServiceShell.exe
  • drstrui.exe
  • egui.exe
  • ekrn.exe
  • epavjobs.exe
  • ForceField.exe
  • FProtTray.exe
  • FPWin.exe
  • fshoster32.exe
  • GDFirewallTray.exe
  • GDSC.exe
  • hijackthis.exe
  • housecalllauncher.exe
  • K7TSUpdT.exe
  • mbam.exe
  • mbamgui.exe
  • mcagent.exe
  • McPvTray.exe
  • mcshell.exe
  • mcshield.exe
  • McSvHost.exe
  • McUICnt.exe
  • mcupdate.exe
  • mcupdmgr.exe
  • MSASCui.exe
  • MsMpEng.exe
  • msseces.exe
  • niu.exe
  • op_mon.exe
  • pctsAuxs.exe
  • pctsGui.exe
  • pctsSvc.exe
  • PSANHost.exe
  • PSUAService.exe
  • PSUNMain.exe
  • RavMonD.exe
  • rcfp.exe
  • rsmain.exe
  • RsMgrSvc.exe
  • RsTray.exe
  • SBAMTray.exe
  • sbamui.exe
  • sguardxup.exe
  • spybotsd.exe
  • starter_avp.exe
  • symerr.exe
  • uiSeAgnt.exe
  • uiUpdateTray.exe
  • uiWatchDog.exe
  • Update.exe
  • update_tmp.exe
  • updater.exe
  • Upgrader.exe
  • usrreq.exe
  • uWinMgr.exe
  • WRSA.exe
  • zatray.exe