RTKT_FESTI.NET

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes commands from a remote malicious user, effectively compromising the affected system. It connects to a website to send and receive information.

It deletes itself after execution.

Arrival Details

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This backdoor drops the following files:

• %System%\drivers\z{random letters}{random digit}.sys - also detected as RTKT_FESTI.NET

(Note: %System% is the Windows system folder, which is usually C:\Windows\System32.)

Autostart Technique

This backdoor registers its dropped component as a system service to ensure its automatic execution at every system startup. It does this by creating the following registry entries:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\z{random letters}{random digit}
Type = "1"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\z{random letters}{random digit}
ErrorControl = "0"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\z{random letters}{random digit}
Start = "1"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\z{random letters}{random digit}
ImagePath = "%System%\drivers\z{random letters}5.sys"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\z{random letters}{random digit}
DisplayName = "z{random letters}5.sys"

It registers its dropped component as a system service to ensure its automatic execution at every system startup. It does this by creating the following registry keys:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\z{random letters}{random digit}

Backdoor Routine

This backdoor executes the following commands from a remote malicious user:

• Download Plugin
• Install/Uninstall plugin

It connects to the following websites to send and receive information:

• {BLOCKED}ol33.ru
• {BLOCKED}ort.ru

Other Details

This backdoor deletes itself after execution.

NOTES:

This is the Trend Micro detection for drivers, which hook certain Native API functions to hide files and processes.

This malware hooks the Native API functions ZwEnumerateKey and ZwCreateFile to hide processes and files with a specific file name. The processes and file name to hide come from processes that use this driver.

This backdoor opens the following in order to send and receive packet data over the network:

• \Driver\Tcpip\Device\Tcp
• \FileSystem\Ntfs\Ntfs

The processes it monitors are the following:

• opera.exe
• thebat.exe
• thunderbird.exe
• msimn.exe
• telnet.exe

It monitors accessed sites with the following domains:

• museum
• coop
• aero
• name
• info

It can save information such as system information and data from C&C server to the following registries:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\z{random letters}{random digit}\hwbcr

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\z{random letters}{random digit}\hwsht