BKDR_XPADO.DO

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It does not have any propagation routine.

It executes commands from a remote malicious user, effectively compromising the affected system.

Arrival Details

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This backdoor drops the following component file(s):

• %User Temp%\~df4e74.pdf
• %User Temp%\kb71271.log - deleted afterwards
• {Current Folder}\ka4281x3.log - deleted afterwards
• %Application Data%\Location\WindowsUpdate.exe - also detected as BKDR_XPADO.DO

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.. %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.)

It creates the following folders:

• %Application Data%\Location

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.)

Autostart Technique

This backdoor adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
WindowsUpdate = "%Application Data%\Location\WindowsUpdate.exe"

Propagation

This backdoor does not have any propagation routine.

Backdoor Routine

This backdoor executes the following commands from a remote malicious user:

• Donwload and execute arbitrary file
• Start a process, service and remote shell commands

It connects to the following URL(s) to send and receive commands from a remote malicious user:

• http://{BLOCKED}.248.130/docs/index.jsp?/GAUV96.jsp?{encrypted stolen system information}

Information Theft

This backdoor gathers the following data:

• Host name
• IP number
• Operating system
• Time zone

NOTES:
This malware opens the dropped non-malicious .PDF file %User Temp%\~df4e74.pdf to trick user that it is a legitimate .PDF file.

The malware author can change the contents of index.jsp? in the malicious URL to point to another malicious URL. As of this writing, it is pointing to a non-malicious site.

It does not have rootkit capabilities.

It does not exploit any vulnerability.