TURKOJAN

TURKOJAN is a botnet with remote administration and spying capability. It is commonly bundled with other downloaded applications.

Users can't easily detect its presence due to its stealth mechanism/rootkit capabilities. This is categorized as a high risk malware due to its remote access capability which can control the users machine and environment. It also invades the victims' privacy through its video, audio and chat log features. While it is most probably used for cybercrime, it can also be used to play pranks on infected victims since it is capable of controlling the moouse pointer or flipping the monitor display.

Installation

This backdoor drops the following copies of itself into the affected system:

• %Windows%\microsoft.exe
• %Windows%\mstwain32.exe
• %Windows%\winlogon.exe

(Note: %Windows% is the Windows folder, which is usually C:\Windows.)

It adds the following possibly malicious files or file components:

• %Windows%\cmsetac.dll
• %Windows%\ntdtcstp.dll
• %Windows%\KB8888239.log

(Note: %Windows% is the Windows folder, which is usually C:\Windows.)

Autostart Technique

This backdoor adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
mstwain32 = "%Windows%\mstwain32.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
microsoft = "%Windows%\microsoft.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
winlogon = "%Windows%\winlogon.exe"

Other Details

This backdoor connects to the following possibly malicious URL:

• renan-hi.{BLOCKED}p.org:15963
• noipminhaconta.{BLOCKED}p.biz:15963
• sonsuzluk.{BLOCKED}p.biz:443
• cihaderi.{BLOCKED}p.biz:15963
• {BLOCKED}.{BLOCKED}.152.85:6886