BKDR_FARFLI.XLS

This backdoor spoofs Trend Micro and Skype by using URLs purportedly related to the said brand names. When executed, BKDR_FARFLI.XLS connects to malicious URLs to send sensitive information from the affected system to remote malicious users, as well as receive commands that further compromise system security.

To get a one-glance comprehensive view of the behavior of this Backdoor, refer to the Threat Diagram shown below.

This malware connects to malicious URLs in order to send information to remote malicious users.

This backdoor may be dropped by other malware.

It executes commands from a remote malicious user, effectively compromising the affected system. It connects to a website to send and receive information.

Arrival Details

This backdoor may be dropped by the following malware:

• TROJ_FARFLI.XLS

Installation

This backdoor adds the following mutexes to ensure that only one of its copies runs at any one time:

• {BLOCKED}ndy.trendmicro.org.tw

It is injected into the following processes running in memory:

• svchost.exe

Backdoor Routine

This backdoor executes the following commands from a remote malicious user:

• Download and execute files
• Manipulate files
• Start/Stop services
• Delete services
• Create processes
• Get drive information
• Execute cmd shell commands
• Log keystrokes
• View desktop

It connects to the following websites to send and receive information:

• {BLOCKED}ndy.{BLOCKED}icro.org.tw
• {BLOCKED}ndy.{BLOCKED}m.com.tw