BKDR_POISON.SME1
Windows 2000, Windows XP, Windows Server 2003
![](/vinfo/imgFiles/legend.jpg)
Threat Type: Backdoor
Destructiveness: No
Encrypted: Yes
In the wild: Yes
OVERVIEW
This report is for multiple detected samples. This backdoor arrives contained inside a self-extracting archive (RAR SFX) and attached in email messages. The SFX drops and execute the malware. It also drops encrypted component files. Upon execution, it checks for the account user of the affected system if it has administrator rights. If it does, it copies itself to an alternate data stream (ADS) or as physical file in the %System% driectory. If it doesn't, it copies itself under certain file names.
It stays memory resident by injecting codes in the processes. It queries the default web browser by accessing a registry entry. It then launches a hidden web browser process (e.g. iexplore.exe). It then injects its code in the said process which contains its backdoor routines.
This backdoor arrives as an attachment to email messages spammed by other malware/grayware or malicious users.
TECHNICAL DETAILS
Varies
EXE
Yes
27 Oct 2011
Connects to URLs/IPs, Terminates processes, Modifies system registry, Captures screenshots
Arrival Details
This backdoor arrives as an attachment to email messages spammed by other malware/grayware or malicious users.
Installation
This backdoor adds the following mutexes to ensure that only one of its copies runs at any one time:
- 5-18 rat
- 7-05'rat
- q's rat
- {no mutex}
Autostart Technique
This backdoor adds the following registry entries to enable its automatic execution at every system startup:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Active Setup\Installed Components\{73B2075B-2925-3CDD-64CE-309B5AEB42F2}
StubPath = "{malware path and file name}"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Active Setup\Installed Components\{34DED0E2-8B26-67FC-4718-B8C8A145ADB6}
StubPath = "{malware path and file name}"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Active Setup\Installed Components\{F7356150-ECBF-FC67-C52F-F6F5D70B080D}
StubPath = "{malware path and file name"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Active Setup\Installed Components\{F608F326-3CC4-AF48-BDD5-2614AD7E2923}
StubPath = "{malware path and file name"
Backdoor Routine
This backdoor connects to the following URL(s) to send and receive commands from a remote malicious user:
- {BLOCKED}4.{BLOCKED}4.215.58
- {BLOCKED}irus-groups.com
- {BLOCKED}ir.no-ip.org
NOTES:
This report is for multiple detected samples.
This malware arrives contained inside a self-extracting archive (RAR SFX) and attached in email messages.
The SFX drops and execute this malware as the following:
- %User Temp%\so.exe
- %User Temp%\t120k.exe
- %User Temp%\fuck.exe
- %User Temp%\xxxx.exe
The SFX also drops the following encrypted component files:
- %User Temp%\hol.txt
- %User Temp%\ophcrack.txt
- %User Temp%\offer.txt
- %User Temp%\815anti.txt
Upon execution, it checks for the account user of the affected system if it has administrator rights.
If it does, it copies itself to an alternate data stream (ADS) or as physical file in the %System% driectory:
- %System%:mstrc.scr
- %System%:secrm.scr
- %System%:mscyv.exe
- %System%\winsys.exe
If the user has no administrator rights, it copies itself as the following:
- %User Profile%\Application Data\mscyv.exe
- %User Profile%\Application Data\winsys.exe
- %User Profile%\Application Data\secrm.scr
- %User Profile%\Application Data\mstrc.scr
It copies the encrypted component files as to the following:
- %Program Files%\Outlook Express\msvc7.dll
- %Program Files%\Common Files\ODBC\ODUBC.DLL
- %Program Files%\Common Files\ODBC\odbc.DAT
- %Windows%\system\JQB.dll
- %Windows%\system\VER.SYS
- %System%\jql.sys
It stays memory resident by injecting codes in the following process:
- Explorer.exe
Backdoor Routine
It queries the default web browser by accessing the following registry entry:
HKEY_CLASSES_ROOT\http\shell\open\command
It then launches a hidden web browser process. (e.g. iexplore.exe) The malware then injects its code in the said process which contains its backdoor routines.
This backdoor has the following capabilities:
- Send system information (IP address, computer name, user name, operating system)
- Delete, search, and upload files
- Modify and search the registry entries
- Manage processes and services
- View and terminate active windows and ports
- Perform a shell command
- Download and inject remote codes to legitimate processes
- Log keystrokes and active windows
- Capture screenshots
- View webcam activity
- Listen to microphone audio
- Update/uninstall the malware
SOLUTION
9.200
8.526.03
27 Oct 2011
Step 1
For Windows XP and Windows Server 2003 users, before doing any scans, please make sure you disable System Restore to allow full scanning of your computer.
Step 2
Restart in Safe Mode
Step 3
Delete this registry key
Important: Editing the Windows Registry incorrectly can lead to irreversible system malfunction. Please do this step only if you know how or you can ask assistance from your system administrator. Else, check this Microsoft article first before modifying your computer's registry.
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components
- {73B2075B-2925-3CDD-64CE-309B5AEB42F2}
- {73B2075B-2925-3CDD-64CE-309B5AEB42F2}
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components
- {34DED0E2-8B26-67FC-4718-B8C8A145ADB6}
- {34DED0E2-8B26-67FC-4718-B8C8A145ADB6}
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components
- {F7356150-ECBF-FC67-C52F-F6F5D70B080D}
- {F7356150-ECBF-FC67-C52F-F6F5D70B080D}
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components
- {F608F326-3CC4-AF48-BDD5-2614AD7E2923}
- {F608F326-3CC4-AF48-BDD5-2614AD7E2923}
Step 4
Search and delete these files
- %User Temp%\hol.txt
- %User Temp%\ophcrack.txt
- %User Temp%\offer.txt
- %User Temp%\815anti.txt
- %Program Files%\Outlook Express\msvc7.dll
- %Program Files%\Common Files\ODBC\ODUBC.DLL
- %Program Files%\Common Files\ODBC\odbc.DAT
- %Windows%\system\JQB.dll
- %Windows%\system\VER.SYS
- %System%\jql.sys
Step 5
Restart in normal mode and scan your computer with your Trend Micro product for files detected as BKDR_POISON.SME1. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check this Knowledge Base page for more information.
Did this description help? Tell us how we did.