BKDR_FUPDATE.A

This backdoor may arrive bundled with malware packages as a malware component. It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes commands from a remote malicious user, effectively compromising the affected system.

Arrival Details

This backdoor may arrive bundled with malware packages as a malware component.

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This backdoor adds the following mutexes to ensure that only one of its copies runs at any one time:

• ___exception_{port}___

Other System Modifications

This backdoor creates the following registry entry(ies) to bypass Windows Firewall:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
services\SharedAccess\Parameters\
FirewallPolicy\FirewallRules
{GUID} = "v2.10|Action=Allow|Active=TRUE|Dir=In|App={malware path and filename}|Name=Microsoft IME Dictionary Update|" ← (For Windows Vista and Above)

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\GloballyOpenPorts\
List
{port}:UDP = "{port}:UDP:*:Enabled:Microsoft IME Dictionary Update" ← (For Windows XP and Below)

Backdoor Routine

This backdoor opens the following port(s) where it listens for remote commands:

• 2580

It executes the following commands from a remote malicious user:

• runas - execute commands with Administrator rights
• endx - terminate itself
• Perform remote shell

Other Details

This backdoor does the following:

• Executes the following commands to bypass Windows Firewall:
  • cmd /c netsh adv fi del rule name="Microsoft IME Dictionary Update" & netsh adv fi add rule name="Microsoft IME Dictionary Update" dir=in prog="{malware path and filename}" act=allow - (For Windows Vista and Above)
  • cmd /c netsh fi del po UDP {port} & netsh fi add po UDP {port} "Microsoft IME Dictionary Update" - (For Windows XP and Below)

NOTES:

Where {port} is 2580 by default. It can be modified by adding port as a parameter.

It does not have rootkit capabilities.

It does not exploit any vulnerability.