BKDR_WIPALL.A

This backdoor contains a list of user names and passwords which it uses in its attempt to grant access to the System Root folder of an infected machine. It also installs another backdoor on the system. It is implicated in the Sony Pictures December 2014 attack.

To get a one-glance comprehensive view of the behavior of this Backdoor, refer to the Threat Diagram shown below.

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes the dropped file(s). As a result, malicious routines of the dropped files are exhibited on the affected system.

It connects to certain websites to send and receive information.

Arrival Details

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Autostart Technique

This backdoor registers itself as a system service to ensure its automatic execution at every system startup by adding the following registry entries:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WinsSchMgmt
ImagePath = "{malware path and filename} -k"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WinsSchMgmt
Start = "2"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WinsSchMgmt
DisplayName = "Windows Schedule Management Service"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WinsSchMgmt
ObjectName = "LocalSystem"

It registers as a system service to ensure its automatic execution at every system startup by adding the following registry keys:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WinsSchMgmt
ImagePath = "{malware path and filename} -k"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WinsSchMgmt
Start = "2"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WinsSchMgmt
DisplayName = "Windows Schedule Management Service"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WinsSchMgmt
ObjectName = "LocalSystem"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WinsSchMgmt
Description = "Windows Schedule Management Service"

Dropping Routine

This backdoor drops the following files:

• {malware path}\igfxtrayex.exe - detected as BKDR_WIPALL.B
• %System%\net_ver.dat - contains the following information:
  hostname | IP Address | 2

(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.)

It executes the dropped file(s). As a result, malicious routines of the dropped files are exhibited on the affected system.

Other Details

This backdoor connects to the following website to send and receive information:

• {BLOCKED}.{BLOCKED}.215.64
• {BLOCKED}.{BLOCKED}.33.164
• {BLOCKED}.{BLOCKED}.222.102

NOTES:

This backdoor accepts any of the following arguments:

• -i
• -k
• -s

It attempts to log into shared network using a list of user names and passwords. Once logged in, it grants full access to the machine's System Root folder to everyone on the network.