BKDR_MATSNU.AB

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It deletes itself after execution.

Arrival Details

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This backdoor drops the following copies of itself into the affected system:

• %User Temp%\{random folder name}\{random filename 1}.exe
• %User Temp%\{random filename 2}.pre - deleted afterwards

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.)

It creates the following folders:

• %User Temp%\{random folder name}

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.)

Autostart Technique

This backdoor adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
{random} = "%User Temp%\{random folder name}\{random file name 1}.exe"

Other System Modifications

This backdoor adds the following registry keys:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
taskmgr.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
msconfig.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
regedit.exe

HKEY_CURRENT_USER\SOFTWARE\Microsoft\
Windows\CurrentVersion\Policies\
System

It adds the following registry entries:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\
Windows\CurrentVersion\Policies\
System
DisableRegistryTools = "1"

HKEY_CURRENT_USER\SOFTWARE\Microsoft\
Windows\CurrentVersion\Policies\
System
DisableRegedit = "1"

HKEY_CURRENT_USER\SOFTWARE\Microsoft\
Windows\CurrentVersion\Policies\
System
DisableTaskMgr = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\policies\
system
DisableRegedit = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\policies\
system
DisableTaskMgr = "1"

It deletes the following registry keys:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Network

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Minimal

Other Details

This backdoor connects to the following possibly malicious URL:

• http://{BLOCKED}hi.com/images/1.php
• http://{BLOCKED}isx.com/ca.php
• http://{BLOCKED}isxf.com/TPR0-QQWSKA-423PZS.php
• http://{BLOCKED}dezovc.com/img/1.php
• http://{BLOCKED}olde.com/images/1.php
• http://{BLOCKED}fe.com/img/1.php
• http:/{BLOCKED}z.com/TPR0-QQWSKA-423PZS.php
• http://{BLOCKED}z.com/ad.php
• http://{BLOCKED}dpvsje.com/TPR0-QQWSKA-423PZS.php
• http://{BLOCKED}psoldevsje.com/af.php
• http://{BLOCKED}dv.com/img/1.php
• http://{BLOCKED}o-oum.com/twep.php
• http://{BLOCKED}rz.com/as.php
• http://{BLOCKED}zxrz.com/TPR0-QQWSKA-423PZS.php
• http://{BLOCKED}wieg.com/TPR0-QQWSKA-423PZS.php
• http://{BLOCKED}wieg.com/aa.php
• http://{BLOCKED}wiw.com/img/1.php
• http://{BLOCKED}kiu.com/odriwsd/forum.php
• http://{BLOCKED}bspace-apo.com/user-057708/forumv.php
• http://{BLOCKED}hppf.com/TPR0-QQWSKA-423PZS.php
• http://{BLOCKED}ppf.com/aa.php
• http://{BLOCKED}mn.com/images/1.php
• http://{BLOCKED}olderx.net

It deletes itself after execution.