BKDR_POSTBOT.MS

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It does not have any propagation routine.

It executes commands from a remote malicious user, effectively compromising the affected system.

Arrival Details

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This backdoor adds the following mutexes to ensure that only one of its copies runs at any one time:

• nvkwer23gxdw

Other System Modifications

This backdoor adds the following registry entries:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer
MMID = "{random value}"

Propagation

This backdoor does not have any propagation routine.

Backdoor Routine

This backdoor executes the following commands from a remote malicious user:

• Enumerate all drives with corresponding drive types
• Enumerate files and directories
• Copy, move, rename, or delete files
• Create directories
• Create or terminate processes
• Copy %System%\cmd.exe as %User Temp%\ms1ng2d3d2.exe
• Perform remote shell
• Upload files to C&C server
• Download files from C&C server
• Execute the file %System%\msvid.exe with the parameter /u
• Execute the file %System%\msvid.exe with the parameter /g
• Sleep for a specified amount of time

(Note: %User Temp% is the user's temporary folder, where it usually is C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local\Temp on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

It connects to the following URL(s) to send and receive commands from a remote malicious user:

• {C&C domain name}/{8 random characters}{hard-coded string}
  where {hard-coded string} can be any of the following:
  • ebhfyj.php
  • dcfbht.php
  • cxctgh.php
  • ncxbre.php
  • jxbrte.php
  • mxdber.php
  • vcvbfh.php
  • tbcfjr.php
  • gbcjhg.php
  • dkgwey.php
  • qfgget.php
  • abdgry.php
  • zgfhso.php
  • whcfby.php
  • schrtu.php
  • xbfhyh.php
  • rxxree.php
  • ynhkef.php
  • hcvery.php
  • fxvnht.php
  • bxcvyi.php
  • udbvnx.php

Download Routine

This backdoor saves the files it downloads using the following names:

• %System%\msvid.exe

(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.)

NOTES:

It uses proxy connections by accessing the following URL:

• {Proxy server name}:{Port Number}

The proxy server name and port number depends on the following file:

• {malware path}\mpc.dat

If the said file is not present, it uses the default proxy settings.

It accesses the following URL to read its configuration:

• http://www.{BLOCKED}n.com/style/index2.php

Its configuration contains the C&C domain name information.

It does not have rootkit capabilities.

It does not exploit any vulnerability.