BKDR_PROXY.TORYQ

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It does not have any propagation routine.

It executes commands from a remote malicious user, effectively compromising the affected system.

Arrival Details

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This backdoor drops the following non-malicious file:

• %Application Data%\tcimue.exe ← copy of %System%\cmd.exe

(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.)

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• CXWE34SXIE

Propagation

This backdoor does not have any propagation routine.

Backdoor Routine

This backdoor executes the following commands from a remote malicious user:

• Start or terminate processes or threads
• Download and execute arbitrary files
• Perform remote shell commands
• Enumerate files and directories
• Read files
• Get user name
• Get computer name
• Get OS type and version
• Get processor information
• Get drive information
• Get and use proxy settings
• Sleep for an amount of time

It connects to the following URL(s) to send and receive commands from a remote malicious user:

• http://bueam.{BLOCKED}brea.com/{uri}.asp?{random string}{random numbers}

Information Theft

This backdoor gathers the following data:

• User name
• Computer name
• OS type and version
• Processor information
• Drive information

NOTES:

In the URL it connects to, {uri} may be made up of two or more strings from the following list separated by /:

• field
• email
• name
• nickname
• phone
• sort
• fields
• nickname
• name
• first
• last
• pagesize

And the string {random string} may be any of the following:

• vid=
• pid=
• mid=
• wif=
• address=
• article=

It does not have rootkit capabilities.

It does not exploit any vulnerability.