BKDR_DEMTRAN.SM

This malware is dropped by TROJ_ADOBFP.SMA.

It checks if proxy is enabled on the affected system by checking certain registry entries.

It connects to certain malicious servers and URLs, and waits for commands from a remote malicious user.

It retrieves specific information from the affected system.

This backdoor may be downloaded by other malware/grayware/spyware from remote sites. It may be dropped by other malware.

Arrival Details

This backdoor may be downloaded by other malware/grayware/spyware from remote sites.

It may be dropped by the following malware:

• TROJ_ADOBFP.SMA

Backdoor Routine

This backdoor connects to the following URL(s) to send and receive commands from a remote malicious user:

• {BLOCKED}2.{BLOCKED}3.82.99

NOTES:

Information Theft

This backdoor retrieves the following information from the affected system:

• user name
• host name
• IP address
• Windows version

Other Details
This malware checks if proxy is enabled by checking the following registry entries:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\
Windows\CurrentVersion\Internet Settings
ProxyServer

HKEY_CURRENT_USER\SOFTWARE\Microsoft\
Windows\CurrentVersion\Internet Settings
Proxyenable

• {BLOCKED}2.{BLOCKED}3.82.99\AES{random}O{encrypted data}.jsp?{encrypted data}

• {BLOCKED}2.{BLOCKED}3.82.99\SUS{random}O{random}.jsp?{encrypted data}
• {BLOCKED}2.{BLOCKED}3.82.99\SEU{random}O{random}.jsp?{encrypted data}
• {BLOCKED}2.{BLOCKED}3.82.99\ZES{random}O{random}.jsp?{encrypted data}
• {BLOCKED}2.{BLOCKED}3.82.99\PES{random}O{random}.jsp?{encrypted data}

• exit (terminate)
• put (download file)
• sleep
• dos (execute specified command)
• run (create process)