BKDR_ZEGOST.JY

June 12, 2013
 Analysis by: Adrian Cofreros
 ALIASES:

Backdoor:Win32/Zegost.AK(Microsoft),Trojan.Win32.Jorik.Yoddos.pjh(Kaspersky),BehavesLike.Win32.Malware.eah (mx-v)(Sunbelt)

 PLATFORM:

Windows 2000, Windows Server 2003, Windows XP (32-bit, 64-bit), Windows Vista (32-bit, 64-bit), Windows 7 (32-bit, 64-bit)

 OVERALL RISK RATING:
 DAMAGE POTENTIAL:
 DISTRIBUTION POTENTIAL:
 REPORTED INFECTION:

  • Threat Type: Backdoor

  • Destructiveness: No

  • Encrypted:

  • In the wild: Yes

  OVERVIEW

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It deletes itself after execution.

  TECHNICAL DETAILS

File Size:

28,672 bytes

File Type:

EXE

Memory Resident:

Yes

Initial Samples Received Date:

09 Jun 2013

Arrival Details

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This backdoor drops the following copies of itself into the affected system and executes them:

  • %Program Files%\Internet Explorer\WivnHvelp32.exe

(Note: %Program Files% is the default Program Files folder, usually C:\Program Files in Windows 2000, Server 2003, and XP (32-bit), Vista (32-bit), and 7 (32-bit), or C:\Program Files (x86) in Windows XP (64-bit), Vista (64-bit), and 7 (64-bit).)

Autostart Technique

This backdoor registers itself as a system service to ensure its automatic execution at every system startup by adding the following registry entries:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WinHelpv32
ImagePath = "%Program Files%\Internet Explorer\WivnHvelp32.exe"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WinHelpv32
Type = "10"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WinHelpv32
Start = "2"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WinHelpv32
ErrorControl = "0"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WinHelpv32
DisplayName = "Windvows Help System"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WinHelpv32
ObjectName = "LocalSystem"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WinHelpv32
SYSTEM\CurrentControlSet\Services\WinHelpv32 = "Windows Help System for X32 windows desktop"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WinHelpv32\Security
Security = "{Hex values}"

Other System Modifications

This backdoor adds the following registry keys:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WinHelpv32

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WinHelpv32\Security

Other Details

This backdoor deletes itself after execution.