BKDR_ANDROM.ZE

February 20, 2014
 Analysis by: Mark Joseph Manahan
 ALIASES:

Mal/Generic-L (Sophos) ,Trojan horse Zbot.FFF (AVG) ,W32/Wauchos.X!tr.dldr (Fortinet) ,Worm.Win32.Gamarue (Ikarus) ,Backdoor.Win32.Androm.bmjb (Kaspersky) ,Worm:Win32/Gamarue.I (Microsoft) ,RDN/Downloader.a!oy (McAfee) ,Win32/TrojanDownloader.Wauchos.X trojan (Eset) ,Backdoor.Trojan (Symantec) ,Generic (Panda) ,Trojan.Win32.Generic!BT (Sunbelt)

 PLATFORM:

Windows 2000, Windows Server 2003, Windows XP (32-bit, 64-bit), Windows Vista (32-bit, 64-bit), Windows 7 (32-bit, 64-bit)

 OVERALL RISK RATING:
 DAMAGE POTENTIAL:
 DISTRIBUTION POTENTIAL:
 REPORTED INFECTION:
 INFORMATION EXPOSURE:

  • Threat Type: Backdoor

  • Destructiveness: No

  • Encrypted:

  • In the wild: Yes

  OVERVIEW

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It listens on port(s).

  TECHNICAL DETAILS

File Size:

102,400 bytes

File Type:

EXE

Initial Samples Received Date:

06 Feb 2014

Arrival Details

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This backdoor drops the following copies of itself into the affected system:

  • %ProgramData%\explorer.exe (Windows Vista and 7 only)
  • %All Users Profile%\explorer.exe
  • %All Users Profile%\{random}.exe

(Note: %ProgramData% is a version of the Program Files folder where any user on a multi-user computer can make changes to programs. This is usually C:\ProgramData in Windows Vista and 7, or C:\Program Files on Windows 2000, XP (32-bit), and Server 2003, or C:\Program Files (x86) on Windows XP (64-bit).. %All Users Profile% is the All Users or Common profile folder, which is C:\Documents and Settings\All Users in Windows 2000, XP, and Server 2003, and C:\ProgramData in Windows Vista and 7.)

Autostart Technique

This backdoor adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Start WingMan Profiler = "%All Users Profile%\explorer.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\policies\
Explorer\Run
540 = "%All Users Profile%\{random}.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Start WingMan Profiler = "%ProgramData%\explorer.exe" (Windows Vista and 7 only and if Java update is disabled in startup)

Other System Modifications

This backdoor creates the following registry entry(ies) to bypass Windows Firewall:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\AuthorizedApplications\
List
{malware path and file name} = "{malware path and file name}:*:Enabled:{malware file name}"

Backdoor Routine

This backdoor listens on the following port(s):

  • 3232

Other Details

This backdoor connects to the following possibly malicious URL:

  • http://{BLOCKED}king.ru/se/gate.php
  • http://{BLOCKED}ncodes.ru/se/gate.php
  • http://{BLOCKED}versen.ru/se/gate.php
  • http://{BLOCKED}sdietz.ru/se/gate.php