BKDR_LOLBOT.JI

This backdoor may be dropped by other malware.

It executes commands from a remote malicious user, effectively compromising the affected system.

It retrieves specific information from the affected system.

Arrival Details

This backdoor may be dropped by the following malware:

• TROJ_MDROP.JI

Installation

This backdoor drops the following non-malicious file:

• %Temp%\STZC47D8.TMP

(Note: %Temp% is the Windows Temporary folder, which is usually C:\Windows\Temp or C:\WINNT\Temp.)

Its DLL component is injected to the following process(es):

• SVCHOST.EXE

Autostart Technique

This backdoor registers itself as a system service to ensure its automatic execution at every system startup by adding the following registry entries:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\storage
Type = 110

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\storage
Start = 2

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\storage
ErrorControl = 1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\storage
ImagePath = %SystemRoot%\System32\svchost.exe -k storage

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\storage
DisplayName = "Windows Storage"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\storage
ObjectName = "LocalSystem"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\storage
Description = "Storage service provides a fully redundant data storage infrastructure for storing and retrievingany amount of data."

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\storage\Parameters
ServiceDll = %Program Files%\Common Files\System\STRUNLIB.DLL

Backdoor Routine

This backdoor executes the following commands from a remote malicious user:

• Download File
• Upload File
• Perform remote shell
• Remove itself
• Reconnect to server

It connects to the following URL(s) to send and receive commands from a remote malicious user:

• {BLOCKED}.{BLOCKED}.194.93:443
• {BLOCKED}.{BLOCKED}.22.70:80
• {BLOCKED}on.dyndns.info:443

Dropping Routine

This backdoor drops the following files:

• %Program Files%\Common Files\System\STRUNLIB.DLL - also detected as BKDR_LOLBOT.JI

(Note: %Program Files% is the default Program Files folder, usually C:\Program Files.)

Information Theft

This backdoor retrieves the following information from the affected system:

• System Information
• Running Services
• Running Processes
• Network Configuration

Stolen Information

This backdoor saves the stolen information in the following file:

• %Temp%\SL{Random Characters}.TMP
• %Windows%\inf\isvc.PNF

(Note: %Temp% is the Windows Temporary folder, which is usually C:\Windows\Temp or C:\WINNT\Temp.. %Windows% is the Windows folder, which is usually C:\Windows or C:\WINNT.)

Other Details

This backdoor connects to the following URL(s) to check for an Internet connection:

• www.google.com

It connects to the following URL(s) to get the affected system's IP address:

• checkip.dyndns.org