BKDR_BANDOK.FR

This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes commands from a remote malicious user, effectively compromising the affected system. It connects to a website to send and receive information.

It retrieves specific information from the affected system.

Arrival Details

This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Backdoor drops the following copies of itself into the affected system and executes them:

• %Application Data%\mbsa\mbsa.exe

(Note: %Application Data% is the Application Data folder, where it usually is C:\Documents and Settings\{user name}\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Roaming on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

It adds the following processes:

• iexplore.exe

It creates the following folders:

• %Application Data%\arl

(Note: %Application Data% is the Application Data folder, where it usually is C:\Documents and Settings\{user name}\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Roaming on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• BCcSSUSUSUSu
• CNcmcmcmcjSJs

It injects codes into the following process(es):

• iexplore.exe (added process)

Autostart Technique

This Backdoor adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
mbsa = "%Application Data%\mbsa\mbsa.exe"

Other System Modifications

This Backdoor adds the following registry keys:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion
{Random Numbers} = "{Random String}"

HKEY_CURRENT_USER\Software\Vvvveeeee4
rno1 = "{Random Numbers}.exe"

HKEY_CURRENT_USER\Software\Vvvveeeee4
gn = "{Random Numbers}.exe"

HKEY_CURRENT_USER\Software\Vvvveeeee4
mep = "{Random Numbers}"

HKEY_CURRENT_USER\Software\Vvvveeeee4
api = "{Random Numbers}"

HKEY_CURRENT_USER\Software\Vvvveeeee4
pim = "{Random Numbers}"

HKEY_CURRENT_USER\Software\Vvvveeeee4
tvn = "{Random Numbers}.exe"

HKEY_CURRENT_USER\Software
DFkfkdk333 = "{Random Numbers}"

Backdoor Routine

This Backdoor executes the following commands from a remote malicious user:

• AddAutoFTPToDB
• CaptureScreen
• ChromeInject
• ClearCred
• CompressArchive
• CopyMTP
• DeleteAutoFTPFromDB
• DeleteFileFromDevice
• DisableChrome
• DisableMouseCapture
• EnableAndLoadCapList
• GenerateReports
• GetAutoFTP
• GetCamlist
• GetFileMONLIST
• GetSound
• GetUSBMONLIST
• GetWifi
• GrabFileFromDevice
• PutFileOnDevice
• RarFolder
• SearchMain
• SendCam
• SendFileMonLog
• SendMTPList
• SendMTPList2
• SendStartup
• SendUSBList
• SendinfoList
• SignoutSkype
• SplitMyFile
• StartFileMonitor
• StartShell
• StealUSB
• StopCam
• StopFileMonitor
• StopSearch
• StopUSBMonitor
• Uninstall
• getkey

It connects to the following websites to send and receive information:

• {BLOCKED}ir.net
• http://www.{BLOCKED}blisherslb.com/CU/
• https://www.{BLOCKED}blisherslb.com/CU/

Download Routine

This Backdoor connects to the following URL(s) to download its component file(s):

• http://{BLOCKED}ir.net/mod/

It saves the files it downloads using the following names:

• %Application Data%\mbsa\cpm.dll
• %Application Data%\mbsa\pmd.dll
• %Application Data%\mbsa\2294.exe

(Note: %Application Data% is the Application Data folder, where it usually is C:\Documents and Settings\{user name}\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Roaming on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

Information Theft

This Backdoor retrieves the following information from the affected system:

• User Name
• Computer Name
• OS Version
• IP Address