arrow_back
search
close

BKDR_ANDROM.CRO

December 17, 2014
 Analysis by: Sammy Chua
 ALIASES:

Backdoor.Win32.Androm.fqwl (Kaspersky), VirTool:Win32/VBInject (Microsoft), Win32/TrojanDownloader.Wauchos.AF trojan (ESET)

 PLATFORM:

Windows

 OVERALL RISK RATING:
 DAMAGE POTENTIAL:
 DISTRIBUTION POTENTIAL:
 REPORTED INFECTION:
 INFORMATION EXPOSURE:

  • Threat Type: Backdoor

  • Destructiveness: No

  • Encrypted:

  • In the wild: Yes

  OVERVIEW


This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

  TECHNICAL DETAILS

File Size:

151,552 bytes

File Type:

EXE

Memory Resident:

Yes

Initial Samples Received Date:

16 Dec 2014

Arrival Details

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This backdoor drops the following copies of itself into the affected system:

  • %All Users Profile%\ms{random}.exe

(Note: %All Users Profile% is the All Users folder, where it usually is C:\Documents and Settings\All Users on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\ProgramData on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

Autostart Technique

This backdoor adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\policies\
Explorer\Run
{random number} = "%All Users Profile%\ms{random}.exe"

Other System Modifications

This backdoor adds the following registry entries:

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\policies\
Explorer
TaskbarNoNotification = "0"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\policies\
Explorer
TaskbarNoNotification = "0"

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\policies\
Explorer
HideSCAHealth = "0"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\policies\
Explorer
HideSCAHealth = "0"

It modifies the following registry entries:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
ShowSuperHidden = "0"

(Note: The default value data of the said registry entry is 1.)

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
Hidden = "2"

(Note: The default value data of the said registry entry is 1.)

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\policies\
system
EnableLUA = "0"

Other Details

This backdoor connects to the following possibly malicious URL:

  • http://{BLOCKED}o.net/index.php
  • http://{BLOCKED}rf.net/index.php
  • http://{BLOCKED}s.su/index.php
  • http://{BLOCKED}o.com/index.php