BKDR_VB.JMY

This backdoor may arrive bundled with malware packages as a malware component. It may be unknowingly downloaded by a user while visiting malicious websites.

It executes then deletes itself afterward.

It opens a random port to allow a remote user to connect to the affected system. Once a successful connection is established, the remote user executes commands on the affected system.

It executes the dropped file(s). As a result, malicious routines of the dropped files are exhibited on the affected system.

It executes the downloaded files. As a result, malicious routines of the downloaded files are exhibited on the affected system.

Arrival Details

This backdoor may arrive bundled with malware packages as a malware component.

It may be unknowingly downloaded by a user while visiting malicious websites.

Installation

This backdoor drops the following copies of itself into the affected system:

• %User Temp%\202fbh.exe

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003.)

It drops the following file(s)/component(s):

• %System%\msllhsjn.dll - detected as TSPY_ONLINEG.SMQ

(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.)

It executes then deletes itself afterward.

Autostart Technique

This backdoor adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\policies\
Explorer\Run
a5x3tq = %User Temp%\202fbh.exe

Other System Modifications

This backdoor modifies the following registry key(s)/entry(ies) as part of its installation routine:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SharedAccess
Start = 4

(Note: The default value data of the said registry entry is 2.)

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\wscsvc
Start = 4

(Note: The default value data of the said registry entry is 2.)

Backdoor Routine

This backdoor opens a random port to allow a remote user to connect to the affected system. Once a successful connection is established, the remote user executes commands on the affected system.

Dropping Routine

This backdoor executes the dropped file(s). As a result, malicious routines of the dropped files are exhibited on the affected system.

Download Routine

This backdoor accesses the following websites to download files:

• http://exe.{BLOCKED}texe.com:255/list.php?c={File Properties}

Trend Micro detects the dowloaded file as:

• TSPY_FRETHOG.SMZ

It then executes the downloaded files. As a result, malicious routines of the downloaded files are exhibited on the affected system.

Other Details

This backdoor does the following:

• attempts to establish a connection to the site {BLOCKED}.{BLOCKED}.127.203