BKDR_WISP.AF

This backdoor may be dropped by other malware.

It does not have any propagation routine.

It executes commands from a remote malicious user, effectively compromising the affected system.

It retrieves specific information from the affected system.

Arrival Details

This backdoor may be dropped by the following malware:

• TROJ_WISP.AE

Installation

This backdoor is injected into the following processes running in memory:

• iexplore.exe
• firefox.exe
• outlook.exe

Propagation

This backdoor does not have any propagation routine.

Backdoor Routine

This backdoor executes the following commands from a remote malicious user:

• Perform Remote Shell
• Enumerate Drives
• Enumerate Files
• Start a service
• Execute files
• Terminate itself
• Terminate processes
• Enumerate Processes
• Delete files/folders
• Force Shutdown
• Force Restart
• Force Log-off
• Force Poweroff
• Upload files
• Download files

It connects to the following URL(s) to send and receive commands from a remote malicious user:

• http://{BLOCKED}fo.{BLOCKED}ccerclub.com:443/archive.asp?id={random number}
• http://{BLOCKED}fo.{BLOCKED}ccerclub.com:443/tech.asp?id={random number}

Information Theft

This backdoor retrieves the following information from the affected system:

• Computer name
• OS Version
• MAC Address
• IP address
• Video driver information

Other Details

This backdoor uploads files to the following website(s):

• http://{BLOCKED}fo.{BLOCKED}ccerclub.com:443/item.asp?id={random number}

NOTES:

It download files from the following site:

• http://{BLOCKED}fo.{BLOCKED}soccerclub.com:443/Upload/

It does not have rootkit capabilities.

It does not exploit any vulnerability.