BKDR_FARFLI.XXYV

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes commands from a remote malicious user, effectively compromising the affected system.

Arrival Details

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This backdoor drops the following files:

• {Malware Path}\Myinfo.ini - contains install date information

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• 401156029.{BLOCKED}2.org

Autostart Technique

This backdoor registers as a system service to ensure its automatic execution at every system startup by adding the following registry keys:

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\Hello Kids, this is the demo
Type = "16"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\Hello Kids, this is the demo
Start = "2"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\Hello Kids, this is the demo
ErrorControl = "0"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\Hello Kids, this is the demo
DisplayName = "Hello Kids, this is the demo"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\Hello Kids, this is the demo\Security
Security = "{hex values}"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\Hello Kids, this is the demo
ObjectName = "LocalSystem"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\Hello Kids, this is the demo\Enum
0 = "Root\LEGACY_HELLO_KIDS*002CTHIS_IS_THE_DEMO\0000"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\Hello Kids, this is the demo\Enum
Count = "1"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\Hello Kids, this is the demo\Enum
NextInstance = "1"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\Hello Kids, this is the demo
ImagePath = "{Malware Path and Filename}.exe"

Other System Modifications

This backdoor adds the following registry keys:

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\Hello Kids, this is the demo

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Enum\Root\LEGACY_HELLO_KIDS*002CTHIS_IS_THE_DEMO

It adds the following registry entries:

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Enum\Root\LEGACY_HELLO_KIDS*002CTHIS_IS_THE_DEMO
NextInstance = "1"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Enum\Root\LEGACY_HELLO_KIDS*002CTHIS_IS_THE_DEMO\
0000
*NewlyCreated* = "0"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Enum\Root\LEGACY_HELLO_KIDS*002CTHIS_IS_THE_DEMO\
0000
Service = "Hello Kids, this is the demo"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Enum\Root\LEGACY_HELLO_KIDS*002CTHIS_IS_THE_DEMO\
0000
Legacy = "1"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Enum\Root\LEGACY_HELLO_KIDS*002CTHIS_IS_THE_DEMO\
0000
ConfigFlags = "0"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Enum\Root\LEGACY_HELLO_KIDS*002CTHIS_IS_THE_DEMO\
0000
Class = "LegacyDriver"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Enum\Root\LEGACY_HELLO_KIDS*002CTHIS_IS_THE_DEMO\
0000
ClassGUID = "{GUID}"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Enum\Root\LEGACY_HELLO_KIDS*002CTHIS_IS_THE_DEMO\
0000
DeviceDesc = "Hello Kids, this is the demo"

Backdoor Routine

This backdoor opens the following port(s) where it listens for remote commands:

• TCP 1998

It executes the following commands from a remote malicious user:

• Execute Shell Command
• Download File
• Open/Close a printer - Print a document
• Screen Capture
• Get Connection Information
• Get System Information
• Send Stolen Information

It connects to the following URL(s) to send and receive commands from a remote malicious user:

• 401156029.{BLOCKED}2.org

Information Theft

This backdoor gathers the following data:

• Host's Name
• OS Version
• Drive Information
• Processor Information
• Log keyboard and mouse activities