BKDR_KULUOZ.PFG

This malware disguises as delivery receipts for well-known postal and delivery services firms and airlines.

To get a one-glance comprehensive view of the behavior of this Backdoor, refer to the Threat Diagram shown below.

For the related story, you may read the blog post BKDR_KULUOZ – At a Spam Near You.

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes commands from a remote malicious user, effectively compromising the affected system. It connects to a website to send and receive information.

Arrival Details

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

This malware arrives via the following means:

• spammed email message that disguises as receipt from the following postal/delivery services and airline ticketing system:
  
  Delta Airlines
  American Airlines
  Deutsche Post
  FedEx
  UPS

Installation

This backdoor drops the following copies of itself into the affected system:

• %Application Data%\{random}.exe

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.)

It adds the following processes:

• svchost.exe

It injects codes into the following process(es):

• created svchost.exe

Autostart Technique

This backdoor adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
{random} = "%Application Data%\{random}.exe"

Other System Modifications

This backdoor adds the following registry keys:

HKEY_CURRENT_USER\SOFTWARE\{random}

It adds the following registry entries as part of its installation routine:

HKEY_CURRENT_USER\SOFTWARE\{random}
{random} = "{hex values}"

Backdoor Routine

This backdoor executes the following commands from a remote malicious user:

• idl|Sleep / Idle
• run|Download and Execute Arbitrary file
• rem|Uninstall itself
• rdl|Update copy of injected code in svchost and add encrypted code to registry
• upd|Update copy of main malware
• red|Check latest malware version

It connects to the following websites to send and receive information:

• {BLOCKED}.{BLOCKED}.132.24:8080/{generated value}
• {BLOCKED}.{BLOCKED}.224.202:8080/{generated value}
• {BLOCKED}.{BLOCKED}.63.194:8080/{generated value}
• {BLOCKED}.{BLOCKED}.178.174:8080/{generated value}
• {BLOCKED}.{BLOCKED}.10.68:8080/{generated value}
• {BLOCKED}.{BLOCKED}.81.166:8080/{generated value}
• {BLOCKED}.{BLOCKED}.159.166:8080/{generated value}
• {BLOCKED}.{BLOCKED}.22.146:8080/{generated value}
• {BLOCKED}.{BLOCKED}.50.161:8080/{generated value}
• {BLOCKED}.{BLOCKED}.20.202:8080/{generated value}