BKDR_REDSIP.B

This backdoor may be manually installed by a remote user. It is able to receive commands from said remote user.

When executed, it gathers information and downloads files. It also drops the malware BKDR_REDSIP.C onto affected systems, causing the routines of that backdoor to be exhibited.

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

NOTES:
It may be manuallly installed by a remote malicious user. This backdoor report covers the behavior of both the .EXE dropper and the dropped .DLL files. The .EXE file drops the following files:

• %System%\Connect.dll - also detected as BKDR_REDSIP.B
• %System%\Startup.dll - detected as BKDR_REDSIP.C

It creates the following registry keys:

HKEY_LOCAL_MACHINE\SOFTWARE\RAT

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CryptHost

It creates the following registry entries:

HKEY_LOCAL_MACHINE\SOFTWARE\RAT
connect1 = {BLOCKED}chef.com
connect2 =
port = 25
install = %System%

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CryptHost
Type = 10
Start = 2
ErrorControl = 1
ImagePath = %System Root%\System32\svchost.exe -k CryptHost
ObjectName = LocalSystem

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\
CryptHost\Parameters
ServiceDll = %System%\Startup.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\
CurrentVersion\SvcHost
CryptHost = CryptHost

Upon completing the above-mentioned routines, this .EXE file starts the service CryptHost then proceeds to delete itself.

The following are the behavior of the .DLL also detected as BKDR_REDSIP.B:

It creates the following mutex:

...........

This .DLL reads data from the registry key HKEY_LOCAL_MACHINE\SOFTWARE\RAT, which contains the following information as mentioned above:

• Command and control (C&C) servers
• Port where this backdoor listens
• Install folder

It gathers the following information and saves it in the file, {folder where malware is installed}\HostID.DAT:

• Computer name
• User name
• Operating system
• Drive information
• Processor information

It downloads additional files with the following file names from its C&C server:

• PluginKeyboard.dll
• PluginProcess.dll
• PluginService.dll
• PluginRegedit.dll
• PluginCmd.dll
• PluginScreen.dll
• PluginFile.dll

It can also receive the following commands from its C&C server:

• CMD_KEYBOARD
• CMD_VIDEO
• PLUGIN_INSTALL
• PROCESS_ENUM
• SERVICE_ENUM
• CMD_REGEDIT
• SHELL_CMD
• CMD_UNINSTALL_HOST
• CMD_CLOSE_HOST
• CMD_Screen_Managers
• CMD_RESET_HOST
• CMD_File_Managers
• CMD_File_FIND
• CMD_SET_REM