BKDR_VAWTRAK.YAB

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes commands from a remote malicious user, effectively compromising the affected system. It connects to a website to send and receive information.

Arrival Details

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This backdoor drops the following component file(s):

• %ProgramData%\{random folder name}\{random filename}.dat - BKDR_VAWTRAK.YAB
• %User Temp%\{random folder name}\{random filename}.dat - BKDR_VAWTRAK.YAB

(Note: %ProgramData% is a version of the Program Files folder where any user on a multi-user computer can make changes to programs. This is usually C:\ProgramData in Windows Vista and 7, or C:\Program Files on Windows 2000, XP (32-bit), and Server 2003, or C:\Program Files (x86) on Windows XP (64-bit).. %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.)

It injects codes into the following process(es):

• explorer.exe
• chrome.exe
• firefox.exe
• iexplore.exe

Autostart Technique

This backdoor adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
{random filename} = "regsvr32.exe "%ProgramData%\{random folder name}\{random filename}.dat""

Other System Modifications

This backdoor adds the following registry keys:

HKEY_CLASSES_ROOT\CLSID\{GUID}

HKEY_CURRENT_USER\Software\Classes\
CLSID\{GUID}

It adds the following registry entries:

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Main
NoProtectedModeBanner = "1"

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Main
TabProcGrowth = "0"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings\
Zones\3
2500 = "3"

HKEY_CLASSES_ROOT\CLSID\{GUID}
#cert = "{hex value}"

HKEY_CURRENT_USER\Software\Classes\
CLSID\{GUID}
#sd = "{hex value}"

HKEY_CLASSES_ROOT\CLSID\{GUID}
{GUID} = "{hex value}"

Backdoor Routine

This backdoor executes the following commands from a remote malicious user:

• Update itself
• Download and execute files
• List active processes
• Perform remote shell
• Execute file
• Keylog
• Capture Screenshot
• Monitor sound
• Start/Stop process (iexplore.exe, firefox.exe, outlook.exe, explorer.exe, cmd.exe, taskmgr.exe)
• Inject to process
• Get clipboard data
• Receive config data which is saved on registry

It connects to the following websites to send and receive information:

• {BLOCKED}m.net
• {BLOCKED}m.com
• {BLOCKED}u.com
• {BLOCKED}.{BLOCKED}.192.68

Information Theft

This backdoor attempts to steal stored account information used in the following installed File Transfer Protocol (FTP) clients or file manager software:

• 3D-FTP
• AceBIT
• AceFTP
• ALFTP
• BitKinex
• BlazeFtp
• BulletProof FTP
• ClassicFTP
• CoffeeCup Software
• Cyberduck
• DeluxeFTP
• Directory Opus
• EasyFTP
• ExpanDrive
• FarManager
• FFFTP
• FileZilla
• FlashFXP
• Fling FTP
• FreshFTP
• FTP Commander
• FTP Explorer
• FTP Navigator
• FTPGetter
• FTPNow
• FTPRush
• FTPShell
• FTPVoyager
• FTPWare
• GlobalSCAPE CuteFTP 6 Home
• GlobalSCAPE CuteFTP 7 Home
• GlobalSCAPE CuteFTP 8 Home
• GlobalSCAPE CuteFTP
• GlobalSCAPE CuteFTP 8 Professional
• GlobalSCAPE CuteFTP 6 Professional
• GlobalSCAPE CuteFTP 7 Professional
• GlobalSCAPE CuteFTP Lite
• GlobalSCAPE CuteFTP Pro
• GoFTP
• LeapFTP
• LeechFTP
• LinasFTP
• My FTP
• NetDrive
• NetSarang
• NexusFile
• NovaFTP
• PuTTY
• RhinoSoft
• Robo-FTP
• SecureFX
• SmartFTP
• SoftX FTP
• Staff-FTP
• Titan FTP
• Total Commander
• TurboFTP
• UltraFXP
• WinFTP
• WinSCP
• WS_FTP

It attempts to steal stored email credentials from the following:

• IncrediMail
• Outlook
• PocoMail
• The Bat!
• Thunderbird
• Windows Live Mail
• Windows Mail

It attempts to get stored information such as user names, passwords, and hostnames from the following browsers:

• Epic Browser
• Flock
• K-Meleon
• Mozilla Firefox
• SeaMonkey

NOTES:

This backdoor checks for the presence of the following security-related directories in %Program Files% and %All Users Profile%\Application Data:

• a-squared Anti-Malware
• a-squared HiJackFree
• Agnitum
• Alwil Software
• AnVir Task Manager
• ArcaBit
• AVAST Software
• AVG
• avg8
• Avira GmbH
• Avira
• BitDefender
• BlockPost
• Common Files\Doctor Web
• Common Files\G DATA
• Common Files\P Tools
• Common Files\Symantec Shared
• DefenseWall
• DefenseWall HIPS
• Doctor Web
• DrWeb
• ESET
• f-secure
• FRISK Software
• G DATA
• K7 omputing
• Kaspersky Lab Setup Files
• Kaspersky Lab
• Lavasoft
• Malwarebytes
• Malwarebytes' Anti-Malware
• McAfee
• McAfee.com
• Microsoft Security Client
• Microsoft Security Essentials
• Microsoft\Microsoft Antimalware
• Norton AntiVirus
• Online Solutions
• P Tools Internet Security
• P Tools
• Panda Security
• Positive Technologies
• Sandboxie
• Security Task Manager
• Spyware Terminator
• Sunbelt Software
• Symantec
• Trend Micro
• UAenter
• Vba32
• Xore
• Zillya Antivirus

Once it finds one of the AV installations mentioned above, it then creates the following registry entries to force the AV installation to run under restricted user privileges:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{generated GUID for the AV software} ItemData = "{AV software path}"

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{generated GUID for the AV software} SaferFlags = "0"

The configuration data that is received commonly contains the banking and credit card institutions in which it monitors. However, as of this writing, there is no response from its C&C server.