BKDR_PLUGX.DO

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It does not have any propagation routine.

It executes commands from a remote malicious user, effectively compromising the affected system.

It executes the dropped file(s). As a result, malicious routines of the dropped files are exhibited on the affected system.

It deletes the initially executed copy of itself.

Arrival Details

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This backdoor creates the following folders:

• %All Users Profile%\SxS
• %All Users Profile%\Camera

(Note: %All Users Profile% is the All Users or Common profile folder, which is C:\Documents and Settings\All Users in Windows 2000, XP, and Server 2003, and C:\ProgramData in Windows Vista and 7.)

It stays memory-resident by injecting codes into the following processes:

• msiexec.exe
• svchost.exe

Other System Modifications

This backdoor adds the following registry keys:

HKEY_CLASSES_ROOT\FAST

HKEY_LOCAL_MACHINE\FAST

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Setttings\
5.0\User Agent

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Setttings\
5.0\User Agent\Post Platform

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Setttings\
User Agent

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Setttings\
User Agent\Post Platform

It adds the following registry entries:

HKEY_CLASSES_ROOT\FAST
CLSID = "{random values}"

HKEY_LOCAL_MACHINE\FAST
CLSID = "{random values}"

It creates the following registry entry(ies) to bypass Windows Firewall:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\AuthorizedApplications\
List
%User Temp%\CamMute.exe = "%User Temp%\CamMute.exe:*:Enabled:Camera Mute Control Service for ThinkPad"

Propagation

This backdoor does not have any propagation routine.

Backdoor Routine

This backdoor executes the following commands from a remote malicious user:

• Copy, move, rename, delete files
• Create directories
• Create files
• Enumerate files
• Execute files
• Get drive information
• Get file information
• Open and modify files
• Log keystrokes and active window
• Enumerate TCP and UDP connections
• Enumerate network resources
• Set TCP connection state
• Lock workstation
• Log off user
• Restart/Reboot/Shutdown system
• Display a message box
• Perfrom port mapping
• Enumerate processes
• Get process information
• Terminate processes
• Enumerate registry keys
• Create registry keys
• Delete registry keys
• Copy registry keys
• Enumerate registry entries
• Modify registry entries
• Delete registry values
• Screen capture
• Delete services
• Enumerate services
• Get service information
• Modify services
• Start services
• Perform remote shell
• Connect to a database server and execute SQL statement
• Host Telnet server

It connects to the following URL(s) to send and receive commands from a remote malicious user:

• http://{BLOCKED}e.{BLOCKED}tingrecovery.net:443/update?id={malware ID}

Dropping Routine

This backdoor drops the following files:

• %User Temp%\CamMute.exe
• %User Temp%\CommFunc.dll - detected as BKDR_PLUGX.DO
• %User Temp%\CommFunc.jax - detected as BKDR_PLUGX.DO
• %All Users Profile%\Camera\CamMute.exe
• %All Users Profile%\Camera\CommFunc.dll - detected as BKDR_PLUGX.DO
• %All Users Profile%\Camera\CommFunc.jax - detected as BKDR_PLUGX.DO
• %All Users Profile%\SxS\bug.log

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.. %All Users Profile% is the All Users or Common profile folder, which is C:\Documents and Settings\All Users in Windows 2000, XP, and Server 2003, and C:\ProgramData in Windows Vista and 7.)

It executes the dropped file(s). As a result, malicious routines of the dropped files are exhibited on the affected system.

Information Theft

This backdoor accepts the following parameters:

• -k (bypass firewall)

Other Details

This backdoor deletes the initially executed copy of itself

NOTES:

It does not have rootkit capabilities.

It does not exploit any vulnerability.