BKDR_CORKOW.VDG

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes commands from a remote malicious user, effectively compromising the affected system. It connects to a website to send and receive information.

It retrieves specific information from the affected system.

It requires its main component to successfully perform its intended routine.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Other System Modifications

This Trojan adds the following registry keys:

HKEY_CURRENT_USER\Software\Intel\
{random}

HKEY_CLASSES_ROOT\WbemScripting.SWbemLastError\CurVer\
{Random key}

HKEY_LOCAL_MACHINE\SOFTWARE\­Classes\
­WbemScripting.SWbemLastError\­CurVer\­{Random Key}

It adds the following registry entries:

HKEY_CURRENT_USER\Software\Intel\
{random}
{random string} = {random hex values}

HKEY_CLASSES_ROOT\WbemScripting.SWbemLastError\CurVer\
{Random key}
{random} = "{random hex values}"

HKEY_LOCAL_MACHINE\SOFTWARE\­Classes\
WbemScripting.SWbemLastError\­CurVer\­{Random Key}
{random} = "{random hex values}

Backdoor Routine

This Trojan executes the following commands from a remote malicious user:

• Delete File
• Download files
• Uninstall itself
• Remove itself
• Destroy System
• Update itself

It connects to the following websites to send and receive information:

• {BLOCKED}1ch.com/rtl/cef.php
• {BLOCKED}an.com/rtl/cef.php
• {BLOCKED}ch.com/rtl/sign.php
• {BLOCKED}an.com/rtl/sign.php

Download Routine

This Trojan saves the files it downloads using the following names:

• %User Temp%\{random}.tmp

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.)

Information Theft

This Trojan injects itself into the following web browsers to monitor searches made by the user on the following search engines:

• iexplore.exe
• firefox.exe

It retrieves the following information from the affected system:

• Volume Information
• OS Version
• User Name
• Machine Information
• OS Installation date
• Computer Name

Other Details

This Trojan connects to the following URL(s) to check for an Internet connection:

• http://download.{BLOCKED}supdate.com
• https://{BLOCKED}2.microsoft.com
• http://{BLOCKED}supdate.microsoft.com

It requires its main component to successfully perform its intended routine.

NOTES:

It checks if this malware is executed using the following process:

• svchost.exe
• explorer.exe
• rundll32.exe