X97M_CRIGENT.A

This malware may arrive as an infected Word or Excel document. It uses Windows PowerShell to carry out its malicious routines.

To get a one-glance comprehensive view of the behavior of this Backdoor, refer to the Threat Diagram shown below.

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This backdoor creates the following folders:

• %ApplicationData%\{GUID}

Autostart Technique

This backdoor adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
{GUID} = "wscript.exe %ApplicationData%\{GUID}\{GUID}.vbs"

Backdoor Routine

This backdoor opens the following ports:

• 8123 - Used for Web Proxy (Polipo)
• 9050 - Used for traffic encryption (TOR)

It connects to the following URL(s) to send and receive commands from a remote malicious user:

• http://{BLOCKED}jqj42hu.onion/get.php?s=setup&mom=04B69000-BC25-11E0-0000-3CD92B4C7E25&uid={GUID}
• http://{BLOCKED}jqj42hu.onion/get.php?s=setinfo&uid={GUID}

It posts the following information to its command and control (C&C) server:

• IP Address
• Country code
• Country name
• Region code
• Region name
• City
• Zipcode
• Latitude
• User account privilege
• OS version
• OS architecture
• Domain
• OS Language
• Microsoft Office applications
• Microsoft Office application versions

Download Routine

This backdoor connects to the following URL(s) to download its component file(s):

• http://i.{BLOCKED}n.de/
• http://gg.{BLOCKED}z.cc/
• http://i.{BLOCKED}n.de/

It saves the files it downloads using the following names:

• %ApplicationData%\{GUID}\{GUID}.zip - contains 'tor.exe' and 'polipo.exe'
• %ApplicationData%\{GUID}\tor.exe
• %ApplicationData%\{GUID}\polipo.exe
• %ApplicationData%\{GUID}\{GUID}.vbs - C&C generated file

Other Details

This backdoor connects to the following URL(s) to get the affected system's IP address:

• http://freegeoip.net/json/

It drops the following file(s)/component(s):

• %ApplicationData%\{GUID}\roaminglog - TOR initialization log

NOTES:

This backdoor requires the application Windows PowerShell to execute properly.

This backdoor retrieves the infection routine from the C&C server to infect files with the following extension:

• *.doc
• *.docx
• *.xls
• *.xlsx

This backdoor saves a copy of each *.docx files to *.doc format and *.xlsx files to *.xls format under the same directory and deletes the original file.

This backdoor lowers the security setting of the following applications:

• Microsoft Office Word
• Microsoft Office Excel