BKDR_HIJACKER.AY

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It does not have any propagation routine.

It is a command line program that may be used to perform certain routines. It executes commands from a remote malicious user, effectively compromising the affected system.

It retrieves specific information from the affected system.

Arrival Details

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This backdoor injects codes into the following process(es):

• lsass.exe

Propagation

This backdoor does not have any propagation routine.

Backdoor Routine

This backdoor is a command line program that may be used to perform certain routines.

It executes the following commands from a remote malicious user:

• Download Arbitrary File
• Upload Arbitrary File
• Attempt to login on the SQL Server
• Listen to a port for receiving commands
• Collect System Password Hashes
• Execute Arbitrary File
• Delete Arbitrary File
• Route Network traffic

Dropping Routine

This backdoor drops the following files:

• {malware path}\gw.dat -contains host address in Internet standard dot notation and visible server list in the current domain
• {malware path}\sql.dat -contains host address in Internet standard dot notation and SQL brute login result

Information Theft

This backdoor retrieves the following information from the affected system:

• Server found in the current domain
• Host name
• Local Group Administrators
• Global Group Domain Computers

NOTES:

It uses hard coded dictionary attack on attempting to login on the SQL server (User ID for these passwords is "sa"):

• NULL
• SA
• sa
• 123456
• abcd1234
• sql
• manager
• core
• root
• 1q2w3e
• qwe123
• sa123
• oracle
• sqlserver
• p@ssw0rd
• 1q2w3e4r
• qwer1234
• 1234
• pass
• windows
• system
• admin
• super
• test
• 12345678
• qwerty
• qwertyuiop
• 1qaz2wsx
• pass1234
• 123456789

It reads the following file which also to be use for dictionary attack on attempting to login on SQL server:

• {malware path}\sqlpass.dic

The command line parameters that it can receive are the following:

• Address of the remote connection
• Port to be used for the connection
• Proxy information (address, port)
• Key for exchanges

It does not have rootkit capabilities.

It does not exploit any vulnerability.