BKDR_NANOCORE.SM

This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes commands from a remote malicious user, effectively compromising the affected system.

It gathers certain information on the affected computer.

Arrival Details

This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Backdoor drops the following files:

• %Application Data%\{random CLSID}\run.dat
• %Application Data%\{random CLSID}\Logs{User}\KB_{random}.dat - where keylogger data will be saved

(Note: %Application Data% is the Application Data folder, where it usually is C:\Documents and Settings\{user name}\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Roaming on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

It drops the following copies of itself into the affected system:

• %Application Data%\{random CLSID}\PCI Service\pcisv.exe - when executed as non-admin
• %Program Files%\PCI Service\pcisv.exe - when executed as admin

(Note: %Application Data% is the Application Data folder, where it usually is C:\Documents and Settings\{user name}\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Roaming on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.. %Program Files% is the Program Files folder, where it usually is C:\Program Files on all Windows operating system versions; C:\Program Files (x86) for 32-bit applications running on Windows 64-bit operating systems.)

It creates the following folders:

• %Application Data%\{random CLSID}
• %Application Data%\{random CLSID}\PCI Service
• %Application Data%\{random CLSID}\Logs\{User}
• %Program Files%\PCI Service

(Note: %Application Data% is the Application Data folder, where it usually is C:\Documents and Settings\{user name}\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Roaming on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.. %Program Files% is the Program Files folder, where it usually is C:\Program Files on all Windows operating system versions; C:\Program Files (x86) for 32-bit applications running on Windows 64-bit operating systems.)

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• Global\{CLSID}

Autostart Technique

This Backdoor adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Run
PCI Service = %Program Files%\PCI Service\pcisv.exe

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
PCI Service = %Application Data%\random CLSID}\PCI Service\pcisv.exe

Backdoor Routine

This Backdoor executes the following commands from a remote malicious user:

• Manage its backdoor file
  
  • Update itself
  • Restart connection
  • Terminate itself
  • Uninstall itself
• System Control
  
  • Restart Machine
  • Shutdown Machine
  • Locks the machine
  • Browse Directory
  • View Task Manager
  • Edit Registry
  • Remote CMD
  • Used to DDOS
  • Mouse swap
  • Remote Execution(from web/file)
  • Remote Script Execution
    
    • Html
    • Batch
    • VBS
    • Python
    • Java
    • PHP
  • Recover Browser Passwords
  • Open CDTray
  • Monitor Keyboard
  • Keyboard logging
  • View Monitor/webcam
  • Control Mouse
  • Send Messages / Chat with the attacker

It connects to the following URL(s) to send and receive commands from a remote malicious user:

• {BLOCKED}.{BLOCKED}.181.70:7893

Information Theft

This Backdoor gathers the following information on the affected computer:

• CPU and OS Information
• Malware File Name
• Installed Anti-Virus/Anti-Spyware