BKDR_NFLOG.AGZ

This backdoor may be downloaded by other malware/grayware from remote sites.

It executes commands from a remote malicious user, effectively compromising the affected system.

Arrival Details

This backdoor may be downloaded by the following malware/grayware from remote sites:

• TROJ_NFLOG.AGZ

It may be downloaded from the following remote sites:

• http://www.{BLOCKED}ab.com/NfLog/Nfile.asp

Other System Modifications

This backdoor adds the following registry entries:

HKEY_CURRENT_USER\Software\Microsoft\
Clock
HID = "{hex values}"

Backdoor Routine

This backdoor executes the following commands from a remote malicious user:

• Download files
• Perform remote shell
• Retrieve system information
• Update self

It connects to the following URL(s) to send and receive commands from a remote malicious user:

• http://www.{BLOCKED}ab.com/NfLog/NfCommand.asp
• http://www.{BLOCKED}ab.com/NfLog/NfFile.asp
• http://www.{BLOCKED}ab.com/NfLog/NfHostInfo.asp
• http://www.{BLOCKED}ab.com/NfLog/NfStart.asp
• http://www.{BLOCKED}ab.com/NfLog/NfUpda.asp
• http://www.{BLOCKED}ab.com/NfLog/Nfpredown.asp
• http://www.{BLOCKED}ab.com/NfLog/TTip.asp

It posts the following information to its command and control (C&C) server:

• IP configuration
• Network statistics
• Running processes
• Running services
• System information

Stolen Information

This backdoor saves the stolen information in the following file:

• %Temp%\$NtUninstallKB942388$

(Note: %Temp% is the Windows Temporary folder, which is usually C:\Windows\Temp or C:\WINNT\Temp.)

NOTES:

This backdoor reports system infection by sending IP address and infection time to the following URL via HTTP post:

• http://www.{BLOCKED}ab.com/NfLog/NfStart.asp