BKDR_NBOT.A

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes commands from a remote malicious user, effectively compromising the affected system. It connects to a website to send and receive information.

It terminates itself if it detects it is being run in a virtual environment.

Arrival Details

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This backdoor drops the following copies of itself into the affected system:

• {Root Drive}:\myapp.exe

It injects codes into the following process(es):

• %Program Files%\iexplore.exe

(Note: %Program Files% is the Program Files folder, where it usually is C:\Program Files on all Windows operating system versions; C:\Program Files (x86) for 32-bit applications running on Windows 64-bit operating systems.)

Backdoor Routine

This backdoor executes the following commands from a remote malicious user:

• download arbitrary files
• download and immediately execute updated copy
• download and execute updated copy after reboot
• start SOCKS proxy server
• stop SOCKS proxy server
• reboot the system
• steal cookies
• delete cookies from browsers
• uninstall itself
• download configuration file
• inject codes to site to monitor sites
• capture screenshots

It connects to the following websites to send and receive information:

• http://{BLOCKED}7.{BLOCKED}8.90.193/nbotlogs/debug.php?
  It sends information in the following format: ver={version}&uid={UID}&process={process name}&pid={process ID}&level={value}&error={value}&status={value}&time={value}&message={value}&counter={value}&left={value}&data={stolen data}

Information Theft

This backdoor gathers the following data:

• OS version
• number of processors
• computer name
• username
• current time
• windows directory
• system directory
• program files directory
• application data directory
• screenshots

Other Details

This backdoor terminates itself if it detects it is being run in a virtual environment.

NOTES:

It monitors the following browsers:

• Firefox
• Chrome
• Internet Explorer

Its configuration file may contain the sites and processes that it will monitor. It may perform any of the following once configuration file is received:

• Script injections on specific websites
• Monitor specific processes
• Capture screenshots upon accessing specific sites