BKDR_MAMBA.A

This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It does not have any propagation routine.

It executes commands from a remote malicious user, effectively compromising the affected system. It connects to a website to send and receive information.

Arrival Details

This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Backdoor drops the following copies of itself into the affected system:

• %Application Data%\{string1} {string2}\{string1} {string2}.exe

(Note: %Application Data% is the Application Data folder, where it usually is C:\Documents and Settings\{user name}\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Roaming on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

It creates the following folders:

• %Application Data%\{string1} {string2}\

(Note: %Application Data% is the Application Data folder, where it usually is C:\Documents and Settings\{user name}\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Roaming on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

Autostart Technique

This Backdoor registers itself as a system service to ensure its automatic execution at every system startup by adding the following registry entries:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
services\{string 1}{string 2}
ImagePath = "%Application Data%\{string1} {string2}\{string1} {string2}.exe"

Other System Modifications

This Backdoor adds the following registry entries:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{GUID1}\{GUID2}
{Default} = {encoded values}

Propagation

This Backdoor does not have any propagation routine.

Backdoor Routine

This Backdoor executes the following commands from a remote malicious user:

• Download and execute arbitrary file
• Send stolen information

It connects to the following websites to send and receive information:

• http://{BLOCKED}lle.xyz/get/
• http://{BLOCKED}tate.xyz/get/
• http://{BLOCKED}hared.xyz/get/
• http://{BLOCKED}lper.xyz/get/
• http://{BLOCKED}word.xyz/get/
• http://{BLOCKED}vejob.xyz/get/
• http://{BLOCKED}erstore.xyz/get/
• http://{BLOCKED}erzip.xyz/get/
• http://{BLOCKED}de.xyz/get/
• http://{BLOCKED}nwind.xyz/get/

Rootkit Capabilities

This Backdoor does not have rootkit capabilities.

Information Theft

This Backdoor gathers the following data:

• Volume Serial Number
• MAC Address
• OS Version
• System Type (32bit or 64 bit)
• Screen resolution
• OS Version Service Pack
• Current date and time
• Malware path and filename
• Malware ID and version

Stolen Information

This Backdoor saves the stolen information in the following file:

• {Malware path}\{Malware filename}.dat

Other Details

This Backdoor does the following:

• It checks the existence of the file "C:\ILOVEDBG", if found it will create the file %System Root%\temp\mambalog{number}.txt
• It requires specific python modules to be installed on the machine to proceed with its intended routines.

(Note: %System Root% is the Windows root folder, where it usually is C:\ on all Windows operating system versions.)

NOTES:

{string1} can be any of the following:

• abrupt
• acidic
• adorable
• adventurous
• aggressive
• agitated
• alert
• aloof
• amiable
• amused
• annoyed
• antsy
• anxious
• appalling
• appetizing
• apprehensive
• arrogant
• ashamed
• astonishing
• attractive
• average
• batty
• beefy
• bewildered
• biting
• bitter
• bland
• blushing
• bored
• brave
• bright
• broad
• bulky
• burly
• charming
• cheeky
• cheerful
• chubby
• clean
• clear
• cloudy
• clueless
• clumsy
• colorful
• colossal
• combative
• comfortable
• condemned
• condescending
• confused
• contemplative
• convincing
• convoluted
• cooperative
• corny
• costly
• courageous
• crabby
• creepy
• crooked
• cruel
• cumbersome
• curved
• cynical
• dangerous
• dashing
• decayed
• deceitful
• deep
• defeated
• defiant
• delicious
• delightful
• depraved
• depressed
• despicable
• determined
• dilapidated
• diminutive
• disgusted
• distinct
• distraught
• distressed
• disturbed
• dizzy
• drab
• drained
• dull
• eager
• ecstatic
• elated
• elegant
• emaciated
• embarrassed
• enchanting
• encouraging
• energetic
• enormous
• enthusiastic
• envious
• exasperated
• excited
• exhilarated
• extensive
• exuberant
• fancy
• fantastic
• fierce
• filthy
• flat
• floppy
• fluttering
• foolish
• frantic
• fresh
• friendly
• frightened
• frothy
• frustrating
• funny
• fuzzy
• gaudy
• gentle
• ghastly
• giddy
• gigantic
• glamorous
• gleaming
• glorious
• gorgeous
• graceful
• greasy
• grieving
• gritty
• grotesque
• grubby
• grumpy
• handsome
• happy
• harebrained
• healthy
• helpful
• helpless
• high
• hollow
• homely
• horrific
• huge
• hungry
• hurt
• icy
• ideal
• immense
• impressionable
• intrigued
• irate
• irritable
• itchy
• jealous
• jittery
• jolly
• joyous
• filthy
• flat
• floppy
• fluttering
• foolish
• frantic
• fresh
• friendly
• frightened
• frothy
• frustrating
• funny
• fuzzy
• gaudy
• gentle
• ghastly
• giddy
• gigantic
• glamorous
• gleaming
• glorious
• gorgeous
• graceful
• greasy
• grieving
• gritty
• grotesque
• grubby
• grumpy
• handsome
• happy
• harebrained
• healthy
• helpful
• helpless
• high
• hollow
• homely
• horrific
• huge
• hungry
• hurt
• icy
• ideal
• immense
• impressionable
• intrigued
• irate
• irritable
• itchy
• jealous
• jittery
• jolly
• joyous
• juicy
• jumpy
• kind
• lackadaisical
• large
• lazy
• lethal
• little
• lively
• livid
• lonely
• loose
• lovely
• lucky
• ludicrous
• macho
• magnificent
• mammoth
• maniacal
• massive
• melancholy
• melted
• miniature
• minute
• mistaken
• misty
• moody
• mortified
• motionless
• muddy
• mysterious
• narrow
• nasty
• naughty
• nervous
• nonchalant
• nonsensical
• nutritious
• nutty
• obedient
• oblivious
• obnoxious
• odd
• old-fashioned
• outrageous
• panicky
• perfect
• perplexed
• petite
• petty
• plain
• pleasant
• poised
• pompous
• precious
• prickly
• proud
• pungent
• puny
• quaint
• quizzical
• ratty
• reassured
• relieved
• repulsive
• responsive
• ripe
• robust
• rotten
• rotund
• rough
• round
• salty
• sarcastic
• scant
• scary
• scattered
• scrawny
• selfish
• shaggy
• shaky
• shallow
• sharp
• shiny
• short
• silky
• silly
• skinny
• slimy
• slippery
• small
• smarmy
• smiling
• smoggy
• smooth
• smug
• soggy
• solid
• sore
• sour
• sparkling
• spicy
• splendid
• spotless
• square
• stale
• steady
• steep
• responsive
• sticky
• stormy
• stout
• straight
• strange
• strong
• stunning
• substantial
• successful
• succulent
• superficial
• superior
• swanky
• sweet
• tart
• tasty
• teeny
• tender
• tense
• terrible
• testy
• thankful
• thick
• thoughtful
• thoughtless
• tight
• timely
• tricky
• trite
• troubled
• twitter pated
• uneven
• unsightly
• upset
• uptight
• vast
• vexed
• victorious
• virtuous
• vivacious
• vivid
• wacky
• weary
• whimsical
• whopping
• wicked
• witty
• wobbly
• wonderful
• worried
• yummy
• zany
• zealous
• zippy

And {string2} can be any of the following:

• history
• way
• art
• world
• information
• map
• two
• family
• government
• health
• system
• computer
• meat
• year
• thanks
• music
• person
• reading
• method
• data
• food
• understanding
• theory
• law
• bird
• literature
• problem
• software
• control
• knowledge
• power
• ability
• economics
• love
• internet
• television
• science
• library
• nature
• fact
• product
• idea
• temperature
• investment
• area
• society
• activity
• story
• industry
• media
• thing
• oven
• community
• definition
• safety
• quality
• development
• language
• management
• player
• variety
• video
• week
• security
• country
• exam
• movie
• organization
• equipment
• physics
• analysis
• policy
• series
• thought
• basis
• boyfriend
• direction
• strategy
• technology
• army
• camera
• freedom
• paper
• environment
• child
• instance
• month
• truth
• marketing
• university
• writing
• article
• department
• difference
• goal
• news
• audience
• fishing
• growth
• income
• marriage
• user
• combination
• failure
• meaning
• medicine
• philosophy
• teacher
• communication
• night
• chemistry
• disease
• disk
• energy
• nation
• road
• role
• soup
• advertising
• location
• success
• addition
• apartment
• education
• math
• moment
• painting
• politics
• attention
• decision
• event
• property
• shopping
• student
• wood
• competition
• distribution
• entertainment
• office
• population
• president
• unit
• category
• cigarette
• context
• introduction
• opportunity
• performance
• driver
• flight
• length
• magazine
• newspaper
• relationship
• teaching
• cell
• dealer
• finding
• lake
• member
• message
• phone
• scene
• appearance
• association
• concept
• customer
• death
• discussion
• housing
• inflation
• insurance
• mood
• woman
• advice
• blood
• effort
• expression
• importance
• opinion
• payment
• reality
• responsibility
• situation
• skill
• statement
• wealth
• application
• city
• county
• depth
• estate
• foundation
• grandmother
• heart
• perspective
• photo
• recipe
• studio
• topic
• collection
• depression
• imagination
• passion
• percentage
• resource
• setting
• ad
• agency
• college
• connection
• criticism
• debt
• description
• memory
• patience
• secretary
• solution
• administration
• aspect
• attitude
• director
• personality
• psychology
• recommendation
• response
• selection
• storage
• version
• alcohol
• argument
• complaint
• contract
• emphasis
• highway
• loss
• membership
• possession
• preparation
• steak
• union
• agreement
• cancer
• currency
• employment
• engineering
• entry
• interaction
• mixture
• preference
• region
• republic
• tradition
• virus
• actor
• classroom
• delivery
• device
• difficulty
• drama
• election
• engine
• football
• guidance
• hotel
• owner
• priority
• protection
• suggestion
• tension
• variation
• anxiety
• atmosphere
• awareness
• bath
• bread
• candidate
• climate
• comparison
• confusion
• construction
• elevator
• emotion
• employee
• employer
• guest
• height
• leadership
• mall
• manager
• operation
• recording
• sample
• transportation
• charity
• cousin
• disaster
• editor
• efficiency
• excitement
• extent
• feedback
• guitar
• homework
• leader
• mom
• outcome
• permission
• presentation
• promotion
• reflection
• refrigerator
• resolution
• revenue
• session
• singer
• tennis
• basket
• bonus
• cabinet
• childhood
• church
• clothes
• coffee
• dinner
• drawing
• hair
• hearing
• initiative
• judgment
• lab
• measurement
• mode
• mud
• orange
• poetry
• police
• possibility
• procedure
• queen
• ratio
• relation
• restaurant
• satisfaction
• sector
• signature
• significance
• song
• tooth
• town
• vehicle
• volume
• wife
• accident
• airport
• appointment
• arrival
• assumption
• baseball
• chapter
• committee
• conversation
• database
• enthusiasm
• error
• explanation
• farmer
• gate
• girl
• hall
• historian
• hospital
• injury
• instruction
• maintenance
• manufacturer
• meal
• perception
• pie
• poem
• presence
• proposal
• reception
• replacement
• revolution
• river
• son
• speech
• tea
• village
• warning
• winner
• worker
• writer
• assistance
• breath
• buyer
• chest
• chocolate
• conclusion
• contribution
• cookie
• courage
• dad
• desk
• drawer
• establishment
• examination
• garbage
• grocery
• honey
• impression
• improvement
• independence
• insect
• inspection
• inspector
• king
• ladder
• menu
• penalty
• piano
• potato
• profession
• professor
• quantity
• reaction
• requirement
• salad
• sister
• supermarket
• tongue
• weakness
• wedding
• affair
• ambition
• analyst
• apple
• assignment
• assistant
• bathroom
• bedroom
• beer
• birthday
• celebration
• championship
• cheek
• client
• consequence
• departure
• diamond
• dirt
• ear
• fortune
• friendship
• funeral
• gene
• girlfriend
• hat
• indication
• intention
• lady
• midnight
• negotiation
• obligation
• passenger
• pizza
• platform
• poet
• pollution
• recognition
• reputation
• shirt
• sir
• speaker
• stranger
• surgery
• sympathy
• tale
• throat
• trainer
• uncle
• youth
• time
• work
• film
• water
• money
• example
• while
• business
• study
• game
• life
• form
• air
• day
• place
• number
• part
• field
• fish
• back
• process
• heat
• hand
• experience
• job
• book
• end
• point
• type
• home
• economy
• value
• body
• market
• guide
• interest
• state
• radio
• course
• company
• price
• size
• card
• list
• mind
• trade
• line
• care
• group
• risk
• word
• fat
• force
• key
• light
• training
• name
• school
• top
• amount
• level
• order
• practice
• research
• sense
• service
• piece
• web
• boss
• sport
• fun
• house
• page
• term
• test
• answer
• sound
• focus
• matter
• kind
• soil
• board
• oil
• picture
• access
• garden
• range
• rate
• reason
• future
• site
• demand
• exercise
• image
• case
• cause
• coast
• action
• age
• bad
• boat
• record
• result
• section
• building
• mouse
• cash
• class
• nothing
• period
• plan
• store
• tax
• side
• subject
• space
• rule
• stock
• weather
• chance
• figure
• man
• model
• source
• beginning
• earth
• program
• chicken
• design
• feature
• head
• material
• purpose
• question
• rock
• salt
• act
• birth
• car
• dog
• object
• scale
• sun
• note
• profit
• rent
• speed
• style
• war
• bank
• craft
• half
• inside
• outside
• standard
• bus
• exchange
• eye
• fire
• position
• pressure
• stress
• advantage
• benefit
• box
• frame
• issue
• step
• cycle
• face
• item
• metal
• paint
• review
• room
• screen
• structure
• view
• account
• ball
• discipline
• medium
• share
• balance
• bit
• black
• bottom
• choice
• gift
• impact
• machine
• shape
• tool
• wind
• address
• average
• career
• culture
• morning
• pot
• sign
• table
• task
• condition
• contact
• credit
• egg
• hope
• ice
• network
• north
• square
• attempt
• date
• effect
• link
• post
• star
• voice
• capital
• challenge
• friend
• self
• shot
• brush
• couple
• debate
• exit
• front
• function
• lack
• living
• plant
• plastic
• spot
• summer
• taste
• theme
• track
• wing
• brain
• button
• click
• desire
• foot
• gas
• influence
• notice
• rain
• wall
• base
• damage
• distance
• feeling
• pair
• savings
• staff
• sugar
• target
• text
• animal
• author
• budget
• discount
• file
• ground
• lesson
• minute
• officer
• phase
• reference
• register
• sky
• stage
• stick
• title
• trouble
• bowl
• bridge
• campaign
• character
• club
• edge
• evidence
• fan
• letter
• lock
• maximum
• novel
• option
• pack
• park
• plenty
• quarter
• skin
• sort
• weight
• baby
• background
• carry
• dish
• factor
• fruit
• glass
• joint
• master
• muscle
• red
• strength
• traffic
• trip
• vegetable
• appeal
• chart
• gear
• ideal
• kitchen
• land
• log
• mother
• net
• party
• principle
• relative
• sale
• season
• signal
• spirit
• street
• tree
• wave
• belt
• bench
• commission
• copy
• drop
• minimum
• path
• progress
• project
• sea
• south
• status
• stuff
• ticket
• tour
• angle
• blue
• breakfast
• confidence
• daughter
• degree
• doctor
• dot
• dream
• duty
• essay
• father
• fee
• finance
• hour
• juice
• limit
• luck
• milk
• mouth
• peace
• pipe
• seat
• stable
• storm
• substance
• team
• trick
• afternoon
• bat
• beach
• blank
• catch
• chain
• consideration
• cream
• crew
• detail
• gold
• interview
• kid
• mark
• match
• mission
• pain
• pleasure
• score
• screw
• sex
• shop
• shower
• suit
• tone
• window
• agent
• band
• block
• bone
• calendar
• cap
• coat
• contest
• corner
• court
• cup
• district
• door
• east
• finger
• garage
• guarantee
• hole
• hook
• implement
• layer
• lecture
• lie
• manner
• meeting
• nose
• parking
• partner
• profile
• respect
• rice
• routine
• schedule
• swimming
• telephone
• tip
• winter
• airline
• bag
• battle
• bed
• bill
• bother
• cake
• code
• curve
• designer
• dimension
• dress
• ease
• emergency
• evening
• extension
• farm
• fight
• gap
• grade
• holiday
• horror
• horse
• host
• husband
• loan
• mistake
• mountain
• nail
• noise
• occasion
• package
• patient
• pause
• phrase
• proof
• race
• relief
• sand
• sentence
• shoulder
• smoke
• stomach
• string
• tourist
• towel
• vacation
• west
• wheel
• wine
• arm
• aside
• associate
• bet
• blow
• border
• branch
• breast
• brother
• buddy
• bunch
• chip
• coach
• cross
• document
• draft
• dust
• expert
• floor
• god
• golf
• habit
• iron
• judge
• knife
• landscape
• league
• mail
• mess
• native
• opening
• parent
• pattern
• pin
• pool
• pound
• request
• salary
• shame
• shelter
• shoe
• silver
• tackle
• tank
• trust
• assist
• bake
• bar
• bell
• bike
• blame
• boy
• brick
• chair
• closet
• clue
• collar
• comment
• conference
• devil
• diet
• fear
• fuel
• glove
• jacket
• lunch
• monitor
• mortgage
• nurse
• pace
• panic
• peak
• plane
• reward
• row
• sandwich
• shock
• spite
• spray
• surprise
• till
• transition
• weekend
• welcome
• yard
• alarm
• bend
• bicycle
• bite
• blind
• bottle
• cable
• candle
• clerk
• cloud
• concert
• counter
• flower
• grandfather
• harm
• knee
• lawyer
• leather
• load
• mirror
• neck
• pension
• plate
• purple
• ruin
• ship
• skirt
• slice
• snow
• specialist
• stroke
• switch
• trash
• tune
• zone
• anger
• award
• bid
• bitter
• boot
• bug
• camp
• candy
• carpet
• cat
• champion
• channel
• clock
• comfort
• cow
• crack
• engineer
• entrance
• fault
• grass
• guy
• hell
• highlight
• incident
• island
• joke
• jury
• leg
• lip
• mate
• motor
• nerve
• passage
• pen
• pride
• priest
• prize
• promise
• resident
• resort
• ring
• roof
• rope
• sail
• scheme
• script
• sock
• station
• toe
• tower
• truck
• witness
• a
• you
• it
• can
• will
• if
• one
• many
• most
• other
• use
• make
• good
• look
• help
• go
• great
• being
• few
• might
• still
• public
• read
• keep
• start
• give
• human
• local
• general
• she
• specific
• long
• play
• feel
• high
• tonight
• put
• common
• set
• change
• simple
• past
• big
• possible
• particular
• today
• major
• personal
• current
• national
• cut
• natural
• physical
• show
• try
• check
• second
• call
• move
• pay
• let
• increase
• single
• individual
• turn
• ask
• buy
• guard
• hold
• main
• offer
• potential
• professional
• international
• travel
• cook
• alternative
• following
• special
• working
• whole
• dance
• excuse
• cold
• commercial
• low
• purchase
• deal
• primary
• worth
• fall
• necessary
• positive
• produce
• search
• present
• spend
• talk
• creative
• tell
• cost
• drive
• green
• support
• glad
• remove
• return
• run
• complex
• due
• effective
• middle
• regular
• reserve
• independent
• leave
• original
• reach
• rest
• serve
• watch
• beautiful
• charge
• active
• break
• negative
• safe
• stay
• visit
• visual
• affect
• cover
• report
• rise
• walk
• white
• beyond
• junior
• pick
• unique
• anything
• classic
• final
• lift
• mix
• private
• stop
• teach
• western
• concern
• familiar
• fly
• official
• broad
• comfortable
• gain
• maybe
• rich
• save
• stand
• young
• fail
• heavy
• hello
• lead
• listen
• valuable
• worry
• handle
• leading
• meet
• release
• sell
• finish
• normal
• press
• ride
• secret
• spread
• spring
• tough
• wait
• brown
• deep
• display
• flow
• hit
• objective
• shoot
• touch
• cancel
• chemical
• cry
• dump
• extreme
• push
• conflict
• eat
• fill
• formal
• jump
• kick
• opposite
• pass
• pitch
• remote
• total
• treat
• vast
• abuse
• beat
• burn
• deposit
• print
• raise
• sleep
• somewhere
• advance
• anywhere
• consist
• dark
• double
• draw
• equal
• fix
• hire
• internal
• join
• kill
• sensitive
• tap
• win
• attack
• claim
• constant
• drag
• drink
• guess
• minor
• pull
• raw
• soft
• solid
• wear
• weird
• wonder
• annual
• count
• dead
• doubt
• feed
• forever
• impress
• nobody
• repeat
• round
• sing
• slide
• strip
• whereas
• wish
• combine
• command
• dig
• divide
• equivalent
• hang
• hunt
• initial
• march
• mention
• smell
• spiritual
• survey
• tie
• adult
• brief
• crazy
• escape
• gather
• hate
• prior
• repair
• rough
• sad
• scratch
• sick
• strike
• employ
• external
• hurt
• illegal
• laugh
• lay
• mobile
• nasty
• ordinary
• respond
• royal
• senior
• split
• strain
• struggle
• swim
• train
• upper
• wash
• yellow
• convert
• crash
• dependent
• fold
• funny
• grab
• hide
• miss
• permit
• quote
• recover
• resolve
• roll
• sink
• slip
• spare
• suspect
• sweet
• swing
• twist
• upstairs
• usual
• abroad
• brave
• calm
• concentrate
• estimate
• grand
• male
• mine
• prompt
• quiet
• refuse
• regret
• reveal
• rush
• shake
• shift
• shine
• steal
• suck
• surround
• anybody
• bear
• brilliant
• dare
• dear
• delay
• drunk
• female
• hurry
• inevitable
• invite
• kiss
• neat
• pop
• punch
• quit
• reply
• representative
• resist
• rip
• rub
• silly
• smile
• spell
• stretch
• stupid
• tear
• temporary
• tomorrow
• wake
• wrap
• yesterday