BKDR_PLUGX.TOK

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes commands from a remote malicious user, effectively compromising the affected system.

It does not have any downloading capability.

Arrival Details

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This backdoor drops the following files:

• %Application Data%\{random letter}{random digits}{random letter}\contactlist.doc
• %Application Data%\{random letter}{random digits}{random letter}\mpsvc.dll - also detected as BKDR_PLUGX.TOK

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.)

It drops and executes the following files:

• %Application Data%\{random letter}{random digits}{random letter}\MsMpEng.exe

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.)

It adds the following processes:

• iexplore.exe
• msiexec.exe

Its DLL component is injected to the following process(es):

• executed MsMpEng.exe

It creates the following folders:

• %Application Data%\{random letter}{random digits}{random letter}

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.)

It injects codes into the following process(es):

• created iexplore.exe
• created msiexec.exe

Autostart Technique

This backdoor drops the following shortcut pointing to its copy in the User Startup folder to enable its automatic execution at every system startup:

• %User Startup%\DirectPlayLocalNetFile.lnk - points to %Application Data%\{random letter}{random digit}{random letter}\MsMpEng.exe

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.)

Other System Modifications

This backdoor adds the following registry keys:

HKEY_CLASSES_ROOT\MJ

HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications

HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\
YOSHIDA

HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\
YOSHIDA\Settings

It adds the following registry entries:

HKEY_CLASSES_ROOT\MJ
CLSID = "{CLSID}"

Backdoor Routine

This backdoor executes the following commands from a remote malicious user:

• Copy, move, rename, delete files
• Create directories
• Create files
• Enumerate files
• Execute files
• Get drive information
• Get file information
• Open and modify files
• Log keystrokes and active window
• Enumerate TCP and UDP connections
• Enumerate network resources
• Set TCP connection state
• Lock workstation
• Log off user
• Restart/Reboot/Shutdown system
• Display a message box
• Perfrom port mapping
• Enumerate processes
• Get process information
• Terminate processes
• Enumerate registry keys
• Create registry keys
• Delete registry keys
• Copy registry keys
• Enumerate registry entries
• Modify registry entries
• Delete registry values
• Screen capture
• Delete services
• Enumerate services
• Get service information
• Modify services
• Start services
• Perform remote shell
• Connect to a database server and execute SQL statement
• Host Telnet server

It connects to the following URL(s) to send and receive commands from a remote malicious user:

• {BLOCKED}.{BLOCKED}.59.193

Download Routine

This backdoor does not have any downloading capability.

NOTES:

Upon execution, this backdoor opens its dropped non-malicious file %Application Data%\{random letter}{random digit}{random letter}\contactlist.doc to hide its malicious routines from the user.

It does not have rootkit capabilities.

It does not exploit any vulnerability.