BKDR_ZEGOST.KM

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It deletes itself after execution.

Arrival Details

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This backdoor drops the following copies of itself into the affected system:

• %System%\kkjofpw658.exe

(Note: %System% is the Windows system folder, which is usually C:\Windows\System32.)

Other System Modifications

This backdoor adds the following registry entries:

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\311aafv123132
SYSTEM\CurrentControlSet\Services\311aafv123132 = "Pro4534vides a domain server NI securitghfh"

Other Details

This backdoor connects to the following possibly malicious URL:

• http://www.{BLOCKED}ya.com/dkk.htm
• http://www.{BLOCKED}xa.com/dkk.htm
• http://www.{BLOCKED}wa.com/dkk.htm
• http://www.{BLOCKED}va.com/dkk.htm
• http://www.{BLOCKED}ua.com/dkk.htm
• http://www.{BLOCKED}ta.com/dkk.htm
• http://www.{BLOCKED}sa.com/dkk.htm
• http://www.{BLOCKED}ra.com/dkk.htm
• http://www.{BLOCKED}qa.com/dkk.htm
• http://www.{BLOCKED}pa.com/dkk.htm
• http://www.{BLOCKED}a.com/dkk.htm
• http://{BLOCKED}w.?{random characters}
• http://www.@{BLOCKED}a.com/dkk.htm
• http://www.{BLOCKED}ha.com/dkk.htm
• http://www.{BLOCKED}ga.com/dkk.htm
• http://www.{BLOCKED}fa.com/dkk.htm
• http://www.{BLOCKED}ea.com/dkk.htm
• http://www.{BLOCKED}da.com/dkk.htm
• http://www.{BLOCKED}ca.com/dkk.htm
• http://www.{BLOCKED}ba.com/dkk.htm
• http://www.{BLOCKED}aa.com/dkk.htm
• http://www.{BLOCKED}_a.com/dkk.htm
• http://www.{BLOCKED}za.com/dkk.htm
• http://www.{BLOCKED}oa.com/dkk.htm
• http://www.{BLOCKED}ja.com/dkk.htm
• http://www.i03{BLOCKED}azz@{BLOCKED}a.com/dkk.htm
• http://{BLOCKED}w.j03azz?a.com/dkk.htm
• http://www.{BLOCKED}9a.com/dkk.htm
• http://www.{BLOCKED}8a.com/dkk.htm
• http://www.{BLOCKED}7a.com/dkk.htm
• http://www.{BLOCKED}6a.com/dkk.htm
• http://www.{BLOCKED}5a.com/dkk.htm
• http://www.{BLOCKED}4a.com/dkk.htm
• http://www.{BLOCKED}3a.com/dkk.htm
• http://www.{BLOCKED}2a.com/dkk.htm
• http://www.{BLOCKED}1a.com/dkk.htm
• http://www.{BLOCKED}0a.com/dkk.htm
• http://{BLOCKED}w.z03azz/a.com/dkk.htm
• http://{BLOCKED}w.#13azz†`.com/dkk.htm
• http://{BLOCKED}w./13azzz`.com/dkk.htm
• http://{BLOCKED}w.j13azz?`.com/dkk.htm
• http://{BLOCKED}w.z13azz/`.com/dkk.htm
• http://www.{BLOCKED}ÿ_.com/dkk.htm
• http://www.{BLOCKED}ô_.com/dkk.htm
• http://www.{BLOCKED}ï_.com/dkk.htm
• http://www.{BLOCKED}é_.com/dkk.htm
• http://www.{BLOCKED}è_.com/dkk.htm
• http://www.{BLOCKED}ç_.com/dkk.htm
• http://www.{BLOCKED}æ_.com/dkk.htm
• http://www.{BLOCKED}å_.com/dkk.htm
• http://www.{BLOCKED}ä_.com/dkk.htm
• http://www.{BLOCKED}ã_.com/dkk.htm
• http://www.{BLOCKED}â_.com/dkk.htm
• http://www.{BLOCKED}á_.com/dkk.htm
• http://www.{BLOCKED}à_.com/dkk.htm
• http://www.{BLOCKED}ß_.com/dkk.htm
• http://www.{BLOCKED}Þ_.com/dkk.htm
• http://www.{BLOCKED}Ý_.com/dkk.htm
• http://www.{BLOCKED}Ü_.com/dkk.htm
• http://www.{BLOCKED}Û_.com/dkk.htm
• http://www.{BLOCKED}Ú_.com/dkk.htm
• http://www.{BLOCKED}Ù_.com/dkk.htm
• http://www.{BLOCKED}Ø_.com/dkk.htm
• http://www.{BLOCKED}Ö_.com/dkk.htm
• http://www.{BLOCKED}Õ_.com/dkk.htm
• http://www.{BLOCKED}Ô_.com/dkk.htm
• http://www.{BLOCKED}Ó_.com/dkk.htm
• http://www.{BLOCKED}Ñ_.com/dkk.htm
• http://www.{BLOCKED}Ð_.com/dkk.htm
• http://www.{BLOCKED}Ï_.com/dkk.htm
• http://www.{BLOCKED}Î_.com/dkk.htm
• http://www.{BLOCKED}Í_.com/dkk.htm
• http://www.{BLOCKED}Ì_.com/dkk.htm
• http://www.{BLOCKED}Ë_.com/dkk.htm
• http://www.{BLOCKED}Ê_.com/dkk.htm
• http://www.{BLOCKED}É_.com/dkk.htm
• http://www.{BLOCKED}È_.com/dkk.htm
• http://www.{BLOCKED}Ç_.com/dkk.htm
• http://www.{BLOCKED}Æ_.com/dkk.htm
• http://www.{BLOCKED}Å_.com/dkk.htm
• http://www.{BLOCKED}Ä_.com/dkk.htm
• http://www.{BLOCKED}Ã_.com/dkk.htm
• http://www.{BLOCKED}Â_.com/dkk.htm
• http://www.{BLOCKED}Á_.com/dkk.htm
• http://www.{BLOCKED}À_.com/dkk.htm
• http://www.{BLOCKED}º_.com/dkk.htm
• http://www.{BLOCKED}µ_.com/dkk.htm
• http://www.{BLOCKED}ª_.com/dkk.htm
• http://{BLOCKED}w.#23azz†_.com/dkk.htm
• http://www.{BLOCKED}_.com/dkk.htm
• http://{BLOCKED}w./23azzz_.com/dkk.htm
• http://www.{BLOCKED}y_.com/dkk.htm
• http://www.{BLOCKED}x_.com/dkk.htm
• http://www.{BLOCKED}w_.com/dkk.htm
• http://www.{BLOCKED}v_.com/dkk.htm
• http://www.{BLOCKED}u_.com/dkk.htm
• http://www.{BLOCKED}t_.com/dkk.htm
• http://www.{BLOCKED}s_.com/dkk.htm
• http://www.{BLOCKED}r_.com/dkk.htm
• http://www.{BLOCKED}q_.com/dkk.htm
• http://www.{BLOCKED}p_.com/dkk.htm
• http://www.@{BLOCKED}_.com/dkk.htm
• http://www.{BLOCKED}h_.com/dkk.htm
• http://www.{BLOCKED}g_.com/dkk.htm
• http://www.{BLOCKED}f_.com/dkk.htm
• http://www.{BLOCKED}e_.com/dkk.htm
• http://www.{BLOCKED}d_.com/dkk.htm
• http://www.{BLOCKED}c_.com/dkk.htm
• http://www.{BLOCKED}b_.com/dkk.htm
• http://www.{BLOCKED}a_.com/dkk.htm
• http://www.{BLOCKED}__.com/dkk.htm
• http://www.{BLOCKED}z_.com/dkk.htm
• http://www.{BLOCKED}o_.com/dkk.htm
• http://www.{BLOCKED}j_.com/dkk.htm
• http://www.i23azz@{BLOCKED}_.com/dkk.htm
• http://{BLOCKED}w.j23azz?_.com/dkk.htm
• http://www.{BLOCKED}9_.com/dkk.htm
• http://www.{BLOCKED}8_.com/dkk.htm
• http://www.{BLOCKED}7_.com/dkk.htm
• http://www.{BLOCKED}6_.com/dkk.htm
• http://www.{BLOCKED}5_.com/dkk.htm
• http://www.{BLOCKED}4_.com/dkk.htm
• http://www.{BLOCKED}3_.com/dkk.htm
• http://www.{BLOCKED}2_.com/dkk.htm
• http://www.{BLOCKED}1_.com/dkk.htm
• http://www.{BLOCKED}0_.com/dkk.htm
• http://{BLOCKED}w.z23azz/_.com/dkk.htm
• http://{BLOCKED}w.#33azz†^.com/dkk.htm
• http://{BLOCKED}w./33azzz^.com/dkk.htm
• http://{BLOCKED}w.j33azz?^.com/dkk.htm
• http://{BLOCKED}w.z33azz/^.com/dkk.htm
• http://{BLOCKED}w.#43azz†].com/dkk.htm
• http://{BLOCKED}w./43azzz].com/dkk.htm

It deletes itself after execution.

This report is generated via an automated analysis system.