BKDR_SHIZ.CG

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It connects to a website to send and receive information.

It logs a user's keystrokes to steal information.

Arrival Details

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This backdoor drops the following copies of itself into the affected system:

• %Windows%\AppPatch\{random}.exe

(Note: %Windows% is the Windows folder, which is usually C:\Windows or C:\WINNT.)

It injects itself into the following processes as part of its memory residency routine:

• explorer.exe

Autostart Technique

This backdoor adds the following registry entries to enable its automatic execution at every system startup:

HKEY_USERS\.DEFAULT\Software\
Microsoft\Windows\CurrentVersion\
Run
userinit = "%Windows%\AppPatch\{random}.exe"

HKEY_USERS\.DEFAULT\Software\
Microsoft\Windows NT\CurrentVersion\
Windows
run = "%Windows%\AppPatch\{random}.exe"

It modifies the following registry entry(ies) to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Winlogon
Userinit = "C:\WINDOWS\system32\userinit.exe,%Windows%\AppPatch\{random}.exe,"

(Note: The default value data of the said registry entry is C:\WINDOWS\system32\userinit.exe,.)

HKEY_USERS\.DEFAULT\Software\
Microsoft\Windows NT\CurrentVersion\
Windows
load = "%Windows%\AppPatch\{random}.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Winlogon
System = "%Windows%\AppPatch\{random}.exe"

Other System Modifications

This backdoor adds the following registry entries as part of its installation routine:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft
{random} = "{data}"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Winlogon
{random} = "{data}"

It creates the following registry entry(ies) to bypass Windows Firewall:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\AuthorizedApplications\
List
{malware path and file name} = "{malware path and file name}:*:Enabled:Windows Explorer"

Backdoor Routine

This backdoor connects to the following websites to send and receive information:

• {BLOCKED}m.info

Information Theft

This backdoor logs a user's keystrokes to steal information.

Stolen Information

This backdoor saves the stolen information in the following file:

• %User Profile%\Application Data\{random}
• %User Profile%\Application Data\{random}

(Note: %User Profile% is the current user's profile folder, which is usually C:\Windows\Profiles\{user name} on Windows 98 and ME, C:\WINNT\Profiles\{user name} on Windows NT, and C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003.)

Other Details

This backdoor connects to the following URL(s) to check for an Internet connection:

• www.bing.com
• www.microsoft.com

NOTES:
It blocks access to URLs when the following strings are found in the address bar:

• avast.com
• kaspersky
• 93.191.13.100
• drweb
• eset.com
• antivir
• avira
• virustotal
• virusinfo
• z-oleg.com
• kltest.org.ru
• trendsecure
• anti-malware
• .comodo.com
• google.com

It uses the following referrer when connecting to its C&C server:

• http://www.google.com

It checks for the following processes in memory:

• multi_pot.exe
• HookExplorer.exe
• proc_analyzer.exe
• sckTool.exe
• sniff_hit.exe
• sysAnalyzer.exe
• idag.exe
• ollydbg.exe
• dumpcap.exe
• wireshark.exe
• avp.exe

It is capable of executing the following commands:

• Download updated configuration file
• Disable operating system
• Activate/deactivate itself
• Execute a file
• Inject scripts to a visited webpage
• Block Java execution on a visited webpage
• Block HTTP POST request to a webpage

It is capable of stealing user credentials related the following protocols:

• POP2
• POP3
• NNTP
• FTP

It also steals user accounts on from the following online banking clients, if found installed in a system:

• Inter-PRO Client
• FAKTURA.ru
• RAIFFEISEN
• IBANK
• Agava InterBank