Backdoor.PS1.BUMBLELOADER.ARC

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Detalles de entrada

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Instalación

Agrega los procesos siguientes:

• %System%\WindowsPowerShell\v1.0\powershell.exe -ep bypass -file quotefile.ps1

(Nota: %System% es la carpeta del sistema de Windows, que en el caso de Windows 98 y ME suele estar en C:\Windows\System, en el caso de Windows NT y 2000 en C:\WINNT\System32 y en el caso de Windows 2000(32-bit), XP, Server 2003(32-bit), Vista, 7, 8, 8.1, 2008(64-bit), 2012(64bit) y 10(64-bit) en C:\Windows\System32).

Este malware inyecta códigos en el/los siguiente(s) proceso(s):

• powershell.exe

Termina su ejecución cuando encuentra los siguientes procesos en la memoria del sistema afectado:

• ollydbg.exe
• ProcessHacker.exe
• tcpview.exe
• autoruns.exe
• autorunsc.exe
• filemon.exe
• procmon.exe
• regmon.exe
• procexp.exe
• idaq.exe
• idaq64.exe
• ImmunityDebugger.exe
• Wireshark.exe
• dumpcap.exe
• HookExplorer.exe
• ImportREC.exe
• PETools.exe
• LordPE.exe
• SysInspector.exe
• proc_analyzer.exe
• sysAnalyzer.exe
• sniff_hit.exe
• windbg.exe
• joeboxcontrol.exe
• joeboxserver.exe
• joeboxserver.exe
• ResourceHacker.exe
• x32dbg.exe
• x64dbg.exe
• Fiddler.exe
• httpdebugger.exe

Otros detalles

Hace lo siguiente:

• It hooks APIs of the current process.
• It terminates itself if it finds the following virtual machine/sandbox file artifacts in the affected system:
  • %System%\drivers\VBoxMouse.sys
  • %System%\drivers\VBoxGuest.sys
  • %System%\drivers\VBoxSF.sys
  • %System%\drivers\VBoxVideo.sys
  • %System%\vboxdisp.dll
  • %System%\vboxhook.dll
  • %System%\vboxmrxnp.dll
  • %System%\vboxogl.dll
  • %System%\vboxoglarrayspu.dll
  • %System%\vboxoglcrutil.dll
  • %System%\vboxoglerrorspu.dll
  • %System%\vboxoglfeedbackspu.dll
  • %System%\vboxoglpackspu.dll
  • %System%\vboxoglpassthroughspu.dll
  • %System%\vboxservice.exe
  • %System%\vboxtray.exe
  • %System%\VBoxControl.exe
  • %System%\drivers\balloon.sys
  • %System%\drivers\netkvm.sys
  • %System%\drivers\pvpanic.sys
  • %System%\drivers\viofs.sys
  • %System%\drivers\viogpudo.sys
  • %System%\drivers\vioinput.sys
  • %System%\drivers\viorng.sys
  • %System%\drivers\vioscsi.sys
  • %System%\drivers\vioser.sys
  • %System%\drivers\viostor.sys
• It terminates itself if it finds the following virtual machine/sandbox directory artifacts in the affected system:
  • %Program Files%\oracle\virtualbox\guest additions
  • %Program Files%\qemu-ga
  • %Program Files%\SPICE Guest Tools
• It terminates itself if it finds the following virtual machine/sandbox processes in the affected system's memory:
  • vboxservice.exe
  • vboxtray.exe
  • VMSrvc.exe
  • VMUSrvc.exe
  • qemu-ga.exe
  • vdagent.exe
  • vdservice.exe
  • prl_cc.exe
  • prl_tools.exe
• It terminates itself if it finds the following virtual machine/sandbox network shares in the affected system:
  • VirtualBox Shared Folders
• It terminates itself if it finds the following virtual devices in the affected system:
  • \.\VBoxMiniRdrDN
  • \.\VBoxGuest
  • \.\VBoxTrayIPC
  • \.\pipe\VBoxMiniRdDN
  • \.\pipe\VBoxTrayIPC
• It checks for the following result of a WMI query to the Win32_NTEventLogFile entry to determine if it is being run in a virtual machine or sandbox:
  • vboxvideo
  • VBoxVideoW8
  • VBoxWddm
• It checks for the following result of a WMI query to the Win32_Bus entry to determine if it is being run in a virtual machine or sandbox:
  • ACPIBus_BUS_0
  • PCI_BUS_0
  • PNP_BUS_0
• It checks for the following result of a WMI query to the Win32_PnPEntity entry to determine if it is being run in a virtual machine or sandbox:
  • PCI\VEN_80EE&DEV_CAFE
  • 82801FB
  • 82441FX
  • 82371SB
  • OpenHCD
• It checks for the following result of a WMI query to the Win32_BaseBoard entry to determine if it is being run in a virtual machine or sandbox:
  • VirtualBox
  • Oracle Corporation
• It checks for the following result of a WMI query to the Win32_PnPDevice entry to determine if it is being run in a virtual machine or sandbox:
  • VBOX
  • VEN_VBOX
• It checks for the following result of a WMI query to the Win32_ComputerSystem entry to determine if it is being run in a virtual machine or sandbox:
  • VirtualBox
  • HVM domU
  • VMWare
• It checks for the following result of a WMI query to the Win32_NetworkAdapterConfiguration entry to determine if it is being run in a virtual machine or sandbox:
  • 08:00:27
• Based on analysis of the codes, this malware has the following capabilities:
  • Interprets the following messages as its backdoor commands:
  • shi/dij - inject malicious code into one the following target processes:
  • %Program Files%\Windows Photo Viewer\ImagingDevices.exe
  • %Program Files%\Windows Mail\wab.exe
  • %Program Files%\Windows Mail\wabmig.exe
  • dex - write data into a file named wab.exe and executes it afterwards
  • sdl - delete itself from the infected system via the following command:
  • powershell Remove-Item -Path {File Path} -Force
  • ins - enables persistence by dropping a copy of itself and creating a VBS script that executes the malware copy
  • gdt - recursively delete itself from the infected system via the following command:
  • powershell Remove-Item -Path {File Path} -Force -Recurse

(Nota: %System% es la carpeta del sistema de Windows, que en el caso de Windows 98 y ME suele estar en C:\Windows\System, en el caso de Windows NT y 2000 en C:\WINNT\System32 y en el caso de Windows 2000(32-bit), XP, Server 2003(32-bit), Vista, 7, 8, 8.1, 2008(64-bit), 2012(64bit) y 10(64-bit) en C:\Windows\System32).