BKDR_SHOTODOR.VH

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It adds certain registry entries to disable the Task Manager. This action prevents users from terminating the malware process, which can usually be done via the Task Manager.

It executes commands from a remote malicious user, effectively compromising the affected system.

Arrival Details

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This backdoor drops the following files:

• %User Profile%\{random folder name 1}\wdsrvqxx
• %User Profile%\{random folder name 1}\uzklce.TNQ
• %User Profile%\{random folder name 1}\swqtcntxrk.XIM
• %Application Data%\pid.txt
• %Application Data%\pidloc.txt
• %User Temp%\screens\screenshot{number}.jpeg

(Note: %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003, or C:\Users\{user name} on Windows Vista and 7.. %Application Data% is the Application Data folder, where it usually is C:\Documents and Settings\{user name}\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Roaming on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.. %User Temp% is the user's temporary folder, where it usually is C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local\Temp on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

It drops and executes the following files:

• %User Profile%\{random folder name 1}\hotlss.exe

(Note: %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003, or C:\Users\{user name} on Windows Vista and 7.)

It creates the following folders:

• %User Profile%\{random folder name 1}
• %User Temp%\screens

(Note: %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003, or C:\Users\{user name} on Windows Vista and 7.. %User Temp% is the user's temporary folder, where it usually is C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local\Temp on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

It stays memory-resident by injecting codes into the following processes:

• RegSvcs.exe (v2.0.50727)
• RegAsm.exe (v2.0.50727)
• AppLaunch.exe (v2.0.50727)
• RegSvcs.exe (v4.0.30319)
• RegAsm.exe (v4.0.30319)
• AppLaunch.exe (v4.0.30319)
• twunk_32.exe
• newdev.exe
• ndadmin.exe

Autostart Technique

This backdoor drops the following files:

• %User Profile%\{random folder name 1}\ftprvuzx.cmd - batch file to execute the malware script
• %User Profile%\{random folder name 1}\yvrmcxfibuhla.vbs - vbscript file to execute the dropped batch file
• %User Profile%\{random folder name 1}\run.vbs

(Note: %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003, or C:\Users\{user name} on Windows Vista and 7.)

It creates the following registry entries to enable automatic execution of dropped component at every system startup:

HKCU\Software\Microsoft\
Windows\CurrentVersion\RunOnce
%User Profile%\{random folder name 1} = "%User Profile%\{random folder name 1}\yvrmcxfibuhla.vbs"

It drops the following shortcut pointing to its copy in the User Startup folder to enable its automatic execution at every system startup:

• %Start Menu%\start.lnk

(Note: %Start Menu% is the Start Menu folder, where it usually is C:\Documents and Settings\{user name}\Start Menu on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Roaming\Microsoft\Windows\Start Menu on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

Other System Modifications

This backdoor modifies the following registry entries:

HKEY_LOCAL_MACHINE64\SOFTWARE\Microsoft\
Windows\CurrentVersion\Policies\
System
EnableLUA = "0"

(Note: The default value data of the said registry entry is 1.)

It adds the following registry entries to disable the Task Manager:

HKEY_CURRENT_USER64\Software\Microsoft\
Windows\CurrentVersion\Policies\
System
DisableTaskMgr = "1"

(Note: The default value data of the said registry entry is 0.)

It modifies the following registry entries to hide files with Hidden attributes:

HKEY_CURRENT_USER64\Software\Microsoft\
Windows\CurrentVersion\Policies\
Explorer
NoFolderOptions = "1"

(Note: The default value data of the said registry entry is 0.)

HKEY_CURRENT_USER64\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
ShowSuperHidden = "0"

(Note: The default value data of the said registry entry is 1.)

Backdoor Routine

This backdoor executes the following commands from a remote malicious user:

• Delete all registry entries in:
  • HKCU64\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
  • HKLM64\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
• Log Keystrokes
• Download File
• Open Process
• Manipulate the following to send messages:
  • Skype
  • Facebook
  • Steam
  • Omegle
  • RuneScape

Information Theft

This backdoor gathers the following data:

• malware process id
• malware path
• hostname
• Screenshots
• Keyboard Strokes
• Clipboard Data
• System Time
• Internal Language
• Operating System
• Internal IP
• External IP
• AntiVirus Installed
• Firewall Installed
• Current Active Window

It attempts to steal stored email credentials from the following:

• Outlook Express
• Incredimail
• Eudora
• Microsoft Outlook
• Gmail
• Hotmail
• MSN
• Yahoomail
• Netscapemail
• Thunderbird
• GoogleDesktop
• WindowsMail
• WindowsLivemail
• Minecraft
• JDownloader

It attempts to get stored information such as user names, passwords, and hostnames from the following browsers:

• Internet Explorer
• Firefox
• Chrome
• Opera
• Safari
• SeaMonkey

Stolen Information

This backdoor sends the data it gathers to the following email addresses via SMTP:

• {BLOCKED}orlogzzz@{BLOCKED}il.com

Other Details

This backdoor connects to the following URL(s) to get the affected system's IP address:

• whatismyipaddress.com

NOTES:

This malware takes screenshot every 10 minutes.

It accesses the following SMTP servers in preparation to send its stolen information:

• smtp.gmail.com

It disables the following processes:

• taskmgr.exe
• regedit.exe
• msconfig.exe
• cmd.exe