BKDR_POISON.ZYA

This backdoor may arrive contained inside a self extracting archive (RAR SFX) and attached in email messages. The SFX drops and executes this malware. The SFX also drops encrypted component files. Upon execution, it checks for the account user of the affected system if it has administrator rights. If it does, it copies itself to an alternate data stream (ADS) or as physical file in the %System% directory. It copies the encrypted component files. It stays memory resident by injecting codes in processes.It queries the default web browser by accessing a registry entry. It then launches a hidden web browser process (e.g. iexplore.exe). It then injects its code in the said process which contains its backdoor routines.

This backdoor arrives as an attachment to email messages spammed by other malware/grayware or malicious users.

Arrival Details

This backdoor arrives as an attachment to email messages spammed by other malware/grayware or malicious users.

Installation

This backdoor adds the following mutexes to ensure that only one of its copies runs at any one time:

• lau's PI

Autostart Technique

This backdoor adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Active Setup\Installed Components\{8E12AADC-A55E-3FBE-4C6E-6B6EAC7CAFB5}
StubPath = "{malware path and file name}"

Backdoor Routine

This backdoor connects to the following URL(s) to send and receive commands from a remote malicious user:

• {BLOCKED}4.{BLOCKED}4.215.58

NOTES:

It arrives contained inside a self extracting archive (RAR SFX) and attached in email messages.

The SFX drops and execute this malware as the following:

• %User Temp%\love.exe

The SFX also drops the following encrypted component files:

• %User Temp%\dick.txt

Upon execution, it checks for the account user of the affected system if it has administrator rights.

If it does, it copies itself to an alternate data stream (ADS) or as physical file in the %System% directory:

• %Windows%:adobeupdate.exe

If the user has no administrator rights, it copies itself as the following:

• %User Profile%\Application Data\adobeupdate.exe

It copies the encrypted component files as to the following:

• %Program Files%\Common Files\ODBC\OBDC.dat
• %Windows%\java\classes\jsb.cer

It stays memory resident by injecting codes in the following process:

• Explorer.exe

Backdoor Routine

It queries the default web browser by accessing the following registry entry:

HKEY_CLASSES_ROOT\http\shell\open\command

It then launches a hidden web browser process (e.g. iexplore.exe). The malware then injects its code if the said process which contains its backdoor routines.

This backdoor has the following capabilities:

• Send system information (IP address, computer name, user name, operating system)
• Delete, search, and upload files
• Modify and search the registry entries
• Manage processes and services
• View and terminate active windows and ports
• Perform a shell command
• Download and inject remote codes to legitimate processes
• Log keystrokes and active window
• Capture screenshots
• View webcam activity
• Listen to microphone audio
• Update/uninstall the malware