BKDR_EMOGEN.YHA

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It does not have any propagation routine.

It executes commands from a remote malicious user, effectively compromising the affected system.

Arrival Details

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This backdoor drops the following non-malicious files:

• %User Temp%\~numk217{random number}.tmp

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.)

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• microsoftf070212234012334123asdfeewer

Propagation

This backdoor does not have any propagation routine.

Backdoor Routine

This backdoor executes the following commands from a remote malicious user:

• Download end execute arbitrary files
• Perform remote shell commands
• Start and terminate processes and threads
• Enumerate files
• Get operating system configuration, security information, product ID, and hardware properties, such as RAM, disk space, and network cards
• Delete NTLDR
• Shut down the computer

It connects to the following URL(s) to send and receive commands from a remote malicious user:

• {BLOCKED}3.{BLOCKED}0.246.143:443/b?P={generated value}
• {BLOCKED}toshop.{BLOCKED}pto.org:443/b?P={generated value}

As of this writing, the said sites are inaccessible.

Download Routine

This backdoor accesses the following websites to download files:

• http://blogs.{BLOCKED}hoo.co.jp/{BLOCKED}0_1024/33207298.html
• http://{BLOCKED}shopping.{BLOCKED}og-nifty.com/blog/2013/10/love-life.html

It saves the files it downloads using the following names:

• %User Temp%\index~k{random number}.htm - contains the address of the C&C server

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.)

Information Theft

This backdoor gathers the following data:

• Computer name
• Drive type
• Operating system and version
• Language

NOTES:

It does not have rootkit capabilities.

It does not exploit any vulnerability.