Backdoor.MSIL.BLADABINDI.QCI

This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes commands from a remote malicious user, effectively compromising the affected system.

It gathers certain information on the affected computer. It logs a user's keystrokes to steal information.

Arrival Details

This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Backdoor drops the following copies of itself into the affected system:

• %User Temp%\WindowsServices.exe
• %User Startup%\780bd6b56091ce5e35fbad8ce8517148.exe
• %Program Files%\Tools.exe

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %User Startup% is the current user's Startup folder, which is usually C:\Windows\Profiles\{user name}\Start Menu\Programs\Startup on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Start Menu\Programs\Startup on Windows NT, C:\Documents and Settings\{User name}\Start Menu\Programs\Startup on Windows 2003(32-bit), XP and 2000(32-bit), or C:\Users\{user name}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit), 10(64-bit).. %Program Files% is the default Program Files folder, usually C:\Program Files in Windows 2000(32-bit), Server 2003(32-bit), XP, Vista(64-bit), 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit) , or C:\Program Files (x86) in Windows XP(64-bit), Vista(64-bit), 7(64-bit), 8(64-bit), 8.1(64-bit), 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It adds the following processes:

• netsh.exe firewall add allowedprogram "%Malware location\{Malware Name}.exe" "{Malware Name}.exe" ENABLE

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• 780bd6b56091ce5e35fbad8ce8517148

Autostart Technique

This Backdoor adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
780bd6b56091ce5e35fbad8ce8517148 = %User Temp%\{Malware Name}

Other System Modifications

This Backdoor adds the following registry entries:

HKEY_CURRENT_USER\Environment
SEE_MASK_NOZONECHECKS = 1

HKEY_U\S-1-5-21-2019512041-4230814187-3178073052-1000
di = !

HKEY_CURRENT_USER\Software\780bd6b56091ce5e35fbad8ce8517148
[kl] = {Stolen Information}

Backdoor Routine

This Backdoor executes the following commands from a remote malicious user:

• Download a file
• Execute a file
• Update files
• Take a screenshot of user's screen
• Install and execute plugin
• Uninstall - remove files and registries associated with the malware and revert firewall modification
• Get value/s of HKEY_CURRENT_USER\Software\780bd6b56091ce5e35fbad8ce8517148
• Set value/s of HKEY_CURRENT_USER\Software\780bd6b56091ce5e35fbad8ce8517148
• Delete value/s of HKEY_CURRENT_USER\Software\780bd6b56091ce5e35fbad8ce8517148
• Terminate malware process

It connects to the following URL(s) to send and receive commands from a remote malicious user:

• {BLOCKED}.{BLOCKED}.1.111 6522

Information Theft

This Backdoor gathers the following information on the affected computer:

• AV Products
• System Drive Volume Serial Number
• Capture Device Information
• Machine Name
• User Name
• Date of Infection
• Operating System
• Operating System Service Pack
• System Type (32-bit/64-bit)???
• AV Products
• Values of HKEY_CURRENT_USER\Software\780bd6b56091ce5e35fbad8ce8517148
• Active Window

It logs a user's keystrokes to steal information.