BKDR_DEEPAND.AA

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It runs certain commands that it receives remotely from a malicious user. Doing this puts the affected computer and information found on the computer at greater risk.

It retrieves specific information from the affected system.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan drops the following copies of itself into the affected system and executes them:

• %System%\msaudnte.dat

(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.)

It drops and executes the following files:

• %System%\Drivers\{AE2A3887-A30A-4B39-A5E6-AC891A07AFF3}.sys -> to be detected as RTKT_DEEPAND.AA

(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.)

It adds the following processes:

• regsvr32.exe {loads %System%\msaudnte.dat}

(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.)

Autostart Technique

This Trojan adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\
Services\{AE2A3887-A30A-4B39-A5E6-AC891A07AFF3}
ImagePath = "%System%\Drivers\{AE2A3887-A30A-4B39-A5E6-AC891A07AFF3}.sys"

HKEY_LOCAL_MACHINE\System\CurrentControlSet\
Services\wuauserv
ServiceDll = "%System%\msaudnte.dat"

Other System Modifications

This Trojan adds the following registry entries:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\
Services\wuauserv
{default} = "2"

HKEY_LOCAL_MACHINE\System\CurrentControlSet\
Services\wuauserv
(Default) = "LocalSystem"

HKEY_LOCAL_MACHINE\System\CurrentControlSet\
Services\wuauserv
Security = (hex values)

HKEY_LOCAL_MACHINE\System\CurrentControlSet\
Services\{AE2A3887-A30A-4B39-A5E6-AC891A07AFF3}
Type = "1"

HKEY_LOCAL_MACHINE\System\CurrentControlSet\
Services\{AE2A3887-A30A-4B39-A5E6-AC891A07AFF3}
ErrorControl = "0"

HKEY_LOCAL_MACHINE\System\CurrentControlSet\
Services\{AE2A3887-A30A-4B39-A5E6-AC891A07AFF3}
Start = "1"

Backdoor Routine

This Trojan executes the following command(s) from a remote malicious user:

• List Drive and Description
• List Directory Contents
• Send Outlook Username and Password
• Reverse Shell
• Download Files
• List and Terminate Processes
• Run Arbitrary Files

It connects to the following URL(s) to send and receive commands from a remote malicious user:

• vpn.{BLOCKED}tionssl.com:443
• openssh.{BLOCKED}r.com:53

Information Theft

This Trojan retrieves the following information from the affected system:

• Computer Name
• OS Version
• User Name