BKDR_HIJACKER.AY
TR/Hijacker.Gen(Antivir)
Windows 2000, Windows Server 2003, Windows XP (32-bit, 64-bit), Windows Vista (32-bit, 64-bit), Windows 7 (32-bit, 64-bit)
Threat Type: Backdoor
Destructiveness: No
Encrypted: Yes
In the wild: Yes
OVERVIEW
Downloaded from the Internet, Dropped by other malware
This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.
It does not have any propagation routine.
It is a command line program that may be used to perform certain routines. It executes commands from a remote malicious user, effectively compromising the affected system.
It retrieves specific information from the affected system.
TECHNICAL DETAILS
94,208 bytes
EXE
Yes
22 May 2014
Compromises system security
Arrival Details
This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.
Installation
This backdoor injects codes into the following process(es):
- lsass.exe
Propagation
This backdoor does not have any propagation routine.
Backdoor Routine
This backdoor is a command line program that may be used to perform certain routines.
It executes the following commands from a remote malicious user:
- Download Arbitrary File
- Upload Arbitrary File
- Attempt to login on the SQL Server
- Listen to a port for receiving commands
- Collect System Password Hashes
- Execute Arbitrary File
- Delete Arbitrary File
- Route Network traffic
Dropping Routine
This backdoor drops the following files:
- {malware path}\gw.dat -contains host address in Internet standard dot notation and visible server list in the current domain
- {malware path}\sql.dat -contains host address in Internet standard dot notation and SQL brute login result
Information Theft
This backdoor retrieves the following information from the affected system:
- Server found in the current domain
- Host name
- Local Group Administrators
- Global Group Domain Computers
NOTES:
It uses hard coded dictionary attack on attempting to login on the SQL server (User ID for these passwords is "sa"):
- NULL
- SA
- sa
- 123456
- abcd1234
- sql
- manager
- core
- root
- 1q2w3e
- qwe123
- sa123
- oracle
- sqlserver
- p@ssw0rd
- 1q2w3e4r
- qwer1234
- 1234
- pass
- windows
- system
- admin
- super
- test
- 12345678
- qwerty
- qwertyuiop
- 1qaz2wsx
- pass1234
- 123456789
It reads the following file which also to be use for dictionary attack on attempting to login on SQL server:
- {malware path}\sqlpass.dic
The command line parameters that it can receive are the following:
- Address of the remote connection
- Port to be used for the connection
- Proxy information (address, port)
- Key for exchanges
It does not have rootkit capabilities.
It does not exploit any vulnerability.
SOLUTION
9.700
10.820.07
27 May 2014
10.821.00
27 May 2014
Step 1
Before doing any scans, Windows XP, Windows Vista, and Windows 7 users must disable System Restore to allow full scanning of their computers.
Step 2
Restart in Safe Mode
Step 3
Search and delete these files
- {malware path}\gw.dat
- {malware path}\sql.dat
Step 4
Restart in normal mode and scan your computer with your Trend Micro product for files detected as BKDR_HIJACKER.AY. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check this Knowledge Base page for more information.
Did this description help? Tell us how we did.