BKDR_HUPIGON.DLH

October 09, 2012
 Analysis by: Erika Bianca Mendoza
 PLATFORM:

Windows 2000, Windows XP, Windows Server 2003

 OVERALL RISK RATING:
 DAMAGE POTENTIAL:
 DISTRIBUTION POTENTIAL:
 REPORTED INFECTION:

  • Threat Type: Backdoor

  • Destructiveness: No

  • Encrypted: No

  • In the wild: Yes

  OVERVIEW

This backdoor is composed of 3 files - the client, an intermediary component, and the server.

It creates a .DLL component and registers it as service. To do this, it finds the list of net services from a certain registry. It then creates a service using the searched net service name to allow the malware to execute on reboot.

It attempts to connect to C&C servers. If the connection is successful, it does certain actions.

This backdoor may be unknowingly downloaded by a user while visiting malicious websites.

  TECHNICAL DETAILS

File Size:

290,816 bytes

File Type:

EXE

Memory Resident:

No

Initial Samples Received Date:

19 Sep 2011

Payload:

Connect to C&C servers, Creates a service

Arrival Details

This backdoor may be unknowingly downloaded by a user while visiting malicious websites.

Installation

This backdoor drops the following copies of itself into the affected system:

  • %System%\dssenmh.dll - also detected as BKDR_HUPIGON.DLH

(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.)

NOTES:

It is composed of 3 files - the client, an intermediary component, and the server.

  • Client - controls the affected system by sending out commands using a Graphical User Interface (GUI).

  • Proxy - waits for a command from the client using port 9658 and sends the command to the affected computer.
  • Server - component installed on compromised machines.

It creates a .DLL component, %System%\dssenmh.DLL, and registers it as service. To do this, it finds the list of net services from the following registry:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\
CurrentVersion\Svchost
netsvcs

It then creates a service using the searched net service name to allow the malware to execute on reboot:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\{netsvcs service}\Parameters
ServiceDll = "%System%\dssenmh.dll"

It attempts to connect to the following C&C servers:

  • {BLOCKED}force.rr.nu
  • {BLOCKED}sl.{BLOCKED}ns-ip.com
  • {BLOCKED}6.{BLOCKED}5.131.4

If the connection is successful, it can do the following:

  • Download files
  • Execute commands using cmd.exe
  • Execute files
  • List / access / delete files or folders
  • List drives / get drive information
  • List processes
  • Terminate processes
  • Uninstall
  • Update .DLL component

  SOLUTION

Minimum Scan Engine:

9.200

FIRST VSAPI PATTERN FILE:

8.439.00

FIRST VSAPI PATTERN DATE:

19 Sep 2011

Step 1

For Windows XP and Windows Server 2003 users, before doing any scans, please make sure you disable System Restore to allow full scanning of your computer.

Step 2

Scan your computer with your Trend Micro product and note files detected as BKDR_HUPIGON.DLH

Step 3

Restart in Safe Mode

[ Learn More ]

Step 4

Search and delete this file

[ Learn More ]
There may be some component files that are hidden. Please make sure you check the Search Hidden Files and Folders checkbox in the More advanced options option to include all hidden files and folders in the search result.
  • %System%\dssenmh.dll

Step 5

Restart in normal mode and scan your computer with your Trend Micro product for files detected as BKDR_HUPIGON.DLH. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check this Knowledge Base page for more information.

NOTES:

Perform the following solution step after restarting in safe mode:

To delete the random service key this malware/grayware/spyware created:

  1. Scan your computer with your Trend Micro product and take note of the name of the malware/grayware/spyware detected.
  2. Open Registry Editor. To do this, click Start>Run, type regedit in the text box provided, then press Enter.
  3. Press CTRL+F.
  4. In the Find dialog box, type the file name of the malware detected earlier.
    (Note: Make sure that only the data checkbox is selected, then click Find Next.)

    5. Find.

  5. Once found, in the right panel, check if the result is the following value-data pair:
    ServiceDLL = {Malware/Grayware/Spyware path and file name}
  6. If yes, in the left panel, locate the service where the data is under.
  7. Right-click on the located service in the left panel and choose Delete.
  8. Repeat steps 2 to 6 until the Finished searching through the registry dialog box appears.
  9. Close Registry Editor.


Did this description help? Tell us how we did.