W2KM_HANCITOR.AUSTT

This backdoor arrives as an attachment to email messages spammed by other malware/grayware or malicious users. It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It does not have any propagation routine.

It runs certain commands that it receives remotely from a malicious user. Doing this puts the affected computer and information found on the computer at greater risk. However, as of this writing, the said sites are inaccessible.

It gathers information and reports it to its servers.

Arrival Details

This backdoor arrives as an attachment to email messages spammed by other malware/grayware or malicious users.

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This backdoor injects codes into the following process(es):

• explorer.exe (32-bit version)
• svchost.exe (64-bit version)

Propagation

This backdoor does not have any propagation routine.

Backdoor Routine

This backdoor executes the following command(s) from a remote malicious user:

• Download files
• Execute files
• Download and load a module

It connects to the following URL(s) to send and receive commands from a remote malicious user:

• http://{BLOCKED}ejo.ru/ls5/forum.php
• http://{BLOCKED}okin.ru/ls5/forum.php
• http://{BLOCKED}suprat.com/ls5/forum.php

However, as of this writing, the said sites are inaccessible.

Other Details

This backdoor connects to the following URL(s) to get the affected system's IP address:

• http://api.ipify.org/

It does the following:

• It contains a message that entices customer to enable macro.

It gathers the following information and reports it to its servers:

• OS Version
• IP Address
• Computer Name
• Account Name
• Machine GUID
  
  The information are posted to the server in the following format: GUID={machine guid}&BUILD={malware build version}&INFO={computer name | account name}&IP={IP address}&TYPE=1&WIN={OS version}