BKDR_LIFTOH.AD

This malware is involved in a ZBOT spam campaign that targeted British users. Once the malicious attachment is opened, it inevitable leads to the download of ZBOT malware into the affected system.

To get a one-glance comprehensive view of the behavior of this Backdoor, refer to the Threat Diagram shown below.

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes commands from a remote malicious user, effectively compromising the affected system.

Arrival Details

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This backdoor drops the following copies of itself into the affected system:

• %All Users Profile%\Application Data\{random letters}sacfsfdsf.exe

(Note: %All Users Profile% is the All Users or Common profile folder, which is C:\Documents and Settings\All Users in Windows 2000, XP, and Server 2003, and C:\ProgramData in Windows Vista and 7.)

Autostart Technique

This backdoor adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
{random letters}sacfsfdsf = ""%All Users Profile%\Application Data\{random letters}sacfsfdsf.exe""

Other System Modifications

This backdoor adds the following registry keys:

HKEY_CURRENT_USER\Software\{random letters}sacfsfdsf

It adds the following registry entries as part of its installation routine:

HKEY_CURRENT_USER\Software\{random letters}sacfsfdsf
CurrentPath111 = "%All Users Profile%\Application Data\{random letters}sacfsfdsf.exe"

Backdoor Routine

This backdoor executes the following commands from a remote malicious user:

• Download configuration file
• Update copy of itself
• Download and Execute possibly malicious files
• Inject arbitrary routines to a running process

It connects to the following URL(s) to send and receive commands from a remote malicious user:

• 404.{BLOCKED}dns.com/feed404/feed.php via port 80

NOTES:
As of this writing, this backdoor receives commands from its C&C server to download files from the following URLs:

• feedweb.{BLOCKED}dn.net//feedswebz/html/myupdates.exe

• %All Users Profile%\Application Data\{random file name}.exe - detected as TROJ_AGENT.BGTI