PRORAT

PRORAT is a family of backdoors that serves as a remote administration tool (RAT). Variants of this malware family first appeared in 2005.

It opens random ports to establish connection with a remote attacker. Once a connection is established, the remote attacker can execute commands such as creating/opening/closing/deleting files, monitoring visited websites, and retrieving system information among others. It also monitors user names and passwords in the following messaging applications:

• ICQ

• MSN Messenger

• NetMeeting

• Outlook Express

• Yahoo! Messenger

It also obtains email addresses by accessing the following:

• Messenger Address Book

• Outlook Address Book

• Trillian Address Book

PRORAT also steals information such as the retrieved data stated above. It sends the stolen information to certain IPs and URLs.

Installation

This backdoor drops the following files:

• %System%\reginv.dll
• %System%\winkey.dll
• %System%\drivers\oreans32.sys

(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.)

It drops the following copies of itself into the affected system:

• %System%\fservice.exe
• %System%\sservice.exe
• %Windows%\services.exe
• %Windows%\system\sservice.exe
• %Windows%\winlogon.exe

(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.. %Windows% is the Windows folder, which is usually C:\Windows or C:\WINNT.)

Autostart Technique

This backdoor adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\policies\
Explorer\Run
DirectX For Microsoft® Windows = "%System%\fservice.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}
StubPath = "%Windows%\system\sservice.exe"

It modifies the following registry entries to ensure it automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Winlogon
Shell = "Explorer.exe %System%\fservice.exe"

(Note: The default value data of the said registry entry is Explorer.exe.)

Other System Modifications

This backdoor deletes the following files:

• %System%\Restore\MachineGuid.txt

(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.)

It adds the following registry entries as part of its installation routine:

HKEY_CURRENT_USER\Software\Microsoft DirectX\
WinSettings
Bulas = "1"

HKEY_CURRENT_USER\Software\Microsoft DirectX\
WinSettings
FW_KILL = "1"

HKEY_CURRENT_USER\Software\Microsoft DirectX\
WinSettings
XP_FW_Disable = "1"

HKEY_CURRENT_USER\Software\Microsoft DirectX\
WinSettings
XP_SYS_Recovery = "1"

HKEY_CURRENT_USER\Software\Microsoft DirectX\
WinSettings
ICQ_UIN = ""

HKEY_CURRENT_USER\Software\Microsoft DirectX\
WinSettings
Kurban_Ismi = "bdsdo`jr`o"

HKEY_CURRENT_USER\Software\Microsoft DirectX\
WinSettings
Mail = "btsdmhfiu^Ainul`hm/bnl"

HKEY_CURRENT_USER\Software\Microsoft DirectX\
WinSettings
Online_List = ""

HKEY_CURRENT_USER\Software\Microsoft DirectX\
WinSettings
Port = "4001"

HKEY_CURRENT_USER\Software\Microsoft DirectX\
WinSettings
Sifre = "0370"

HKEY_CURRENT_USER\Software\Microsoft DirectX\
WinSettings
Hata = ""

HKEY_CURRENT_USER\Software\Microsoft DirectX\
WinSettings
KSil = "1"

HKEY_CURRENT_USER\Software\Microsoft\
Windows NT Script Host\Microsoft DxDiag\WinSettings
Bulas = "1"

HKEY_CURRENT_USER\Software\Microsoft\
Windows NT Script Host\Microsoft DxDiag\WinSettings
FW_KILL = "1"

HKEY_CURRENT_USER\Software\Microsoft\
Windows NT Script Host\Microsoft DxDiag\WinSettings
XP_FW_Disable = "1"

HKEY_CURRENT_USER\Software\Microsoft\
Windows NT Script Host\Microsoft DxDiag\WinSettings
XP_SYS_Recovery = "1"

HKEY_CURRENT_USER\Software\Microsoft\
Windows NT Script Host\Microsoft DxDiag\WinSettings
ICQ_UIN = "084/41/051/069"

HKEY_CURRENT_USER\Software\Microsoft\
Windows NT Script Host\Microsoft DxDiag\WinSettings
Kurban_Ismi = "whbuhl"

HKEY_CURRENT_USER\Software\Microsoft\
Windows NT Script Host\Microsoft DxDiag\WinSettings
Mail = "`cs`i`ljdsoAinul`hm/ed"

HKEY_CURRENT_USER\Software\Microsoft\
Windows NT Script Host\Microsoft DxDiag\WinSettings
Online_List = ""

HKEY_CURRENT_USER\Software\Microsoft\
Windows NT Script Host\Microsoft DxDiag\WinSettings
Port = "4001"

HKEY_CURRENT_USER\Software\Microsoft\
Windows NT Script Host\Microsoft DxDiag\WinSettings
Sifre = "032547"

HKEY_CURRENT_USER\Software\Microsoft\
Windows NT Script Host\Microsoft DxDiag\WinSettings
Hata = ""

HKEY_CURRENT_USER\Software\Microsoft\
Windows NT Script Host\Microsoft DxDiag\WinSettings
KSil = "0"

HKEY_CURRENT_USER\Software\Microsoft\
Windows NT Script Host\Microsoft DxDiag\WinSettings
ICQ_UIN2 = ""

HKEY_CURRENT_USER\Software\Microsoft\
Windows NT Script Host\Microsoft DxDiag\WinSettings
LanNotifie = ""

HKEY_CURRENT_USER\Software\Microsoft\
Windows NT Script Host\Microsoft DxDiag\WinSettings
Tport = "0"

HKEY_CURRENT_USER\Software\Microsoft\
Windows NT Script Host\Microsoft DxDiag\WinSettings
ServerVersionInt = "19"

It modifies the following registry key(s)/entry(ies) as part of its installation routine:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\SystemRestore
DisableSR = "1"

(Note: The default value data of the said registry entry is 0.)

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\sr
Start = "4"

(Note: The default value data of the said registry entry is 0.)

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\sr\Parameters
FirstRun = "1"

(Note: The default value data of the said registry entry is 0.)

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\srservice
Start = "4"

(Note: The default value data of the said registry entry is 2.)

It adds the following registry keys as part of its installation routine:

HKEY_CURRENT_USER\Software\Microsoft DirectX

HKEY_CURRENT_USER\Software\Microsoft\
Windows NT Script Host

HKEY_CURRENT_USER\Software\Microsoft\
Windows NT Script Host\Microsoft DxDiag

HKEY_CURRENT_USER\Software\Microsoft DirectX\
WinSettings

HKEY_CURRENT_USER\Software\Microsoft\
Windows NT Script Host\Microsoft DxDiag\WinSettings

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}

HKEY_CURRENT_USER\Software\Microsoft\
Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}

It creates the following registry entry(ies) to bypass Windows Firewall:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SharedAccess\Parameters\
FirewallPolicy\DomainProfile\AuthorizedApplications\
List
%Windows%\winlogon.exe = "%Windows%\winlogon.exe:*:Disabled:winlogon"

Other Details

This backdoor connects to the following possibly malicious URL:

• {BLOCKED}.{BLOCKED}.23.201
• {BLOCKED}u.edu.tr
• {BLOCKED}a.edu.tr
• {BLOCKED}i.edu.tr
• {BLOCKED}e.edu.tr