BKDR_SHELL.AU

This backdoor may be dropped by other malware.

It executes commands from a remote malicious user, effectively compromising the affected system.

It logs a user's keystrokes to steal information.

It deletes the initially executed copy of itself.

Arrival Details

This backdoor may be dropped by the following malware:

• TROJ_ARTIEF.TOBI

Installation

This backdoor drops the following copies of itself into the affected system:

• %System%\tpframe.exe

(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.)

It injects itself into the following processes as part of its memory residency routine:

• svchost.exe

Autostart Technique

This backdoor adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\policies\
Explorer\run
tpbar = "%System%\tpframe.exe"

Other System Modifications

This backdoor adds the following registry keys:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\policies\
Explorer

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\policies\
Explorer\run

Backdoor Routine

This backdoor executes the following commands from a remote malicious user:

• Perform remote shell commands

It connects to the following URL(s) to send and receive commands from a remote malicious user:

• {BLOCKED}o.dtdns.net

It posts the following information to its command and control (C&C) server:

• Computer name
• OEMCP
• User name

Information Theft

This backdoor logs a user's keystrokes to steal information.

Stolen Information

This backdoor saves the stolen information in the following file:

• %User Temp%\~{hex string}.tmp

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003.)

Other Details

This backdoor deletes the initially executed copy of itself

NOTES:

This backdoor checks for the presence of the following processes:

• 360tray.exe
• avastsvc.exe
• avguard.exe
• avp.exe
• ccsvchst.exe
• mcagent.exe
• op_mon.exe
• pctstray.exe
• v3ltray.exe
• v3svc.exe
• vsserv.exe

If the said processes are found in the system, it terminates itself and not execute as intended.