BKDR_SCAR.TU

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It runs certain commands that it receives remotely from a malicious user. Doing this puts the affected computer and information found on the computer at greater risk. It connects to a website to send and receive information.

It deletes the initially executed copy of itself.

Arrival Details

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This backdoor drops the following copies of itself into the affected system:

• %Program Files%\NetServices\Schied.exe

(Note: %Program Files% is the default Program Files folder, usually C:\Program Files.)

It creates the following folders:

• %Program Files%\NetServices

(Note: %Program Files% is the default Program Files folder, usually C:\Program Files.)

Autostart Technique

This backdoor adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Active Setup\Installed Components\{A0XC6A98-A14C-J35H-46UD-F5AR862J2AH5}
StubPath = "%Program Files%\NetServices\Schied.exe"

Other System Modifications

This backdoor adds the following registry keys as part of its installation routine:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Active Setup\Installed Components\{A0XC6A98-A14C-J35H-46UD-F5AR862J2AH5}

Backdoor Routine

This backdoor executes the following command(s) from a remote malicious user:

• Execute command shell (cmd.exe)
• Execute process
• Log keystrokes
• Retrieve system information

It connects to the following websites to send and receive information:

• http://{BLOCKED}nny2017.rr.nu/mail.asp
• http://{BLOCKED}.sitelutions.com

Other Details

This backdoor deletes the initially executed copy of itself

NOTES:

This malware also connects to the aforementioned URLs to report system infection and to send system information such as the following:

• Host name
• OS version
• User name
• Volume information