BKDR_CORUM.A

This backdoor may arrive bundled with malware packages as a malware component.

It exports functions used by other malware. It deletes the initially executed copy of itself.

Arrival Details

This backdoor may arrive bundled with malware packages as a malware component.

Installation

This backdoor drops the following copies of itself into the affected system:

• %System Root%\Documents and Settings\All Users\Application Data\Microsoft\OpenGL\~{random}.dll
• %System Root%\Documents and Settings\All Users\Application Data\Microsoft\OpenGL\~3BF.tmp
• %System Root%\Documents and Settings\All Users\Application Data\Microsoft\OpenGL\~3BF.tmp32
• %System Root%\Documents and Settings\All Users\Application Data\Microsoft\OpenGL\~3BF.tmp64
• %System%\MurocApc.dll
• %System%\Setup\MurocApc.dll
• {malware path}\~022356.tme

(Note: %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.. %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.)

It creates the following folders:

• %System Root%\Documents and Settings\All Users\Application Data\Microsoft\OpenGL
• %Program Files%\Microsoft\OpenGL
• %Program Files%\Microsoft\Search Enhancement Pack\OpenGL

(Note: %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.. %Program Files% is the default Program Files folder, usually C:\Program Files.)

Autostart Technique

This backdoor adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Winlogon\
Notify\ZmEvMon
DLLName = "%Program Files%\Microsoft\OpenGL\MurocApc.dll"

Other System Modifications

This backdoor adds the following registry entries as part of its installation routine:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings
GlobalUserOffline = "0"

HKEY_CURRENT_USER\Software\Sysinternals\
Junction
EulaAccepted = "1"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SharedAccess\Parameters\
FirewallPolicy\DomainProfile\AuthorizedApplications\
List
%System%\rundll32.exe = "%System%\rundll32.exe:*:Enabled:Run a DLL as an App"

It adds the following registry keys as part of its installation routine:

HKEY_CLASSES_ROOT\Briefcase.Server

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Briefcase.Server

HKEY_CURRENT_USER\Software\Sysinternals\
Junction

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Winlogon\
Notify\ZmEvMon

Other Details

This backdoor exports functions used by other malware.

It connects to the following possibly malicious URL:

• http://pere{BLOCKED}bs.com/hj_logo.jpg
• http://www.{BLOCKED}w.cn/Images/hj_logo.jpg

It deletes the initially executed copy of itself

NOTES:

It copies all folders and files found in the following directories: Operating System major version is 5 (XP, 2000, 2003):
From: %System%\Setup
To: %Program Files%\Microsoft\OpenGL

From: %System%
To: %Program Files%\Microsoft\Search Enhancement Pack\OpenGL

(Note: %System% is the Windows system folder, which is usually C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003. %Program Files% is the default Program Files folder, usually C:\Program Files.)