BKDR_BTMINE.DDOS

This backdoor is a part of a Bitcoin mining malware. It is used to perform DDoS attacks and aids other component malware in stealing Bitcoins from targeted entities.

To get a one-glance comprehensive view of the behavior of this Backdoor, refer to the Threat Diagram shown below.

This backdoor contains a list of IP addresses that it tries to connect to in order to send receive information, download other malware, get a new list of IP addresses, and get a list of sites to launch DDoS attacks.

This malware is a part of a package that generate BitCoins. Its component malware BKDR_BTMINE.DDOS performs DDOS attacks against targeted entities.

This backdoor may be downloaded by other malware/grayware/spyware from remote sites. It may be unknowingly downloaded by a user while visiting malicious websites.

Arrival Details

This backdoor may be downloaded by other malware/grayware/spyware from remote sites.

It may be unknowingly downloaded by a user while visiting malicious websites.

Installation

This backdoor drops the following copies of itself into the affected system:

• %Windows%\update.7.1\svchostdriver.exe

(Note: %Windows% is the Windows folder, which is usually C:\Windows or C:\WINNT.)

It creates the following folders:

• %Windows%\update.7.1

(Note: %Windows% is the Windows folder, which is usually C:\Windows or C:\WINNT.)

Autostart Technique

This backdoor registers itself as a system service to ensure its automatic execution at every system startup by adding the following registry entries:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\ddservice
Type = "10"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\ddservice
Start = "2"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\ddservice
ErrorControl = "0"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\ddservice
ImagePath = "%Windows%\update.7.1\svchostdriver.exe srv"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\ddservice
DisplayName = "ddservice"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\ddservice
ObjectName = "LocalSystem"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\ddservice\Security
Security = "{hex values}"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\ddservice\Enum
0 = "Root\LEGACY_DDSERVICE\0000"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\ddservice\Enum
Count = "1"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\ddservice\Enum
NextInstance = "1"

It adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
ddsoft = "%Windows%\update.7.1\svchostdriver.exe"

It adds and runs the following services:

• HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ddservice

Other System Modifications

This backdoor adds the following registry keys:

HKEY_LOCAL_MACHINE\SOFTWARE\ddsoft

It adds the following registry entries:

HKEY_LOCAL_MACHINE\SOFTWARE\ddsoft
close = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\ddsoft
ver = "2.63"

Process Termination

This backdoor terminates processes or services that contain any of the following strings if found running in the affected system's memory:

• agava
• agava_start
• agnitum
• alwil
• avast
• avast_start
• avira
• avira_start
• comodo
• comodo_start
• doctor web
• drweb
• drweb_start
• eset
• ESET NOD32 Antivirus
• ESET Smart Security
• ESET SysInspector
• ESET SysRescue
• kaspersky
• Kaspersky Internet Security 2009
• Kaspersky Internet Security 2010
• Kaspersky Internet Security 2011
• Kaspersky Internet Security 7.0
• KAV_2008
• KAV_2009
• KAV_2010
• KAV_2011
• KAV_START
• KAV_TXT
• KAV_UNINSTALL
• KAV_URL
• mcafee
• mcafee_start
• NOD_AV_4_2
• NOD_AV_START
• NOD_SS_4_2
• NOD_SS_START
• NOD_SYSINSP
• NOD_SYSRESC
• NOD_TXT
• NOD_UNINSTALL
• norton
• norton_start
• outpost
• Outpost Firewall Pro 7.0
• outpost_start1
• outpost_start2
• virus

Other Details

This backdoor connects to the following URL(s) to check for an Internet connection:

• youtube.com
• blogspot.com
• baidu.com
• wikipedia.org
• live.com
• twitter.com

NOTES:

It is a part of a Bitcoin mining malware. It is used to perform DDoS attacks and aids other component malware in stealing Bitcoins from targeted entities. It may be part of a package with BKDR_BTMINE.MNR.

It contains a list of IP addresses that it tries to connect to in order to send receive information, download other malware, get a new list of IP addresses, and get a list of sites to launch DDoS attacks. It builds the URL using the following format:

• http://{IP address}/search=error
• http://{IP address}/search=ddos_http_list.txt
• http://{IP address}/search=ddos_http_list
• http://{IP address}/dd/knock.php?sid={value}&ver={malware version}

Some of the IP addresses that the malware tries to connect to are:

• {BLOCKED}9.{BLOCKED}8.234.115
• {BLOCKED}8.{BLOCKED}0.154.168
• {BLOCKED}4.{BLOCKED}2.98.224
• {BLOCKED}8.{BLOCKED}0.136.171
• {BLOCKED}5.{BLOCKED}7.122.106
• {BLOCKED}2.{BLOCKED}7.24.44
• {BLOCKED}1.{BLOCKED}2.131.162
• {BLOCKED}5.{BLOCKED}0.13.140
• {BLOCKED}6.{BLOCKED}7.34.157
• {BLOCKED}8.{BLOCKED}4.64.153