BKDR_NAPOLAR.AR

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes commands from a remote malicious user, effectively compromising the affected system. However, as of this writing, the said sites are inaccessible.

Arrival Details

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This backdoor injects codes into the following process(es):

• explorer.exe
• iexplore.exe

Autostart Technique

This backdoor drops the following file(s) in the Windows User Startup folder to enable its automatic execution at every system startup:

• %User Startup%\lsass.exe

(Note: %User Startup% is the current user's Startup folder, which is usually C:\Windows\Profiles\{user name}\Start Menu\Programs\Startup on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Start Menu\Programs\Startup on Windows NT, and C:\Documents and Settings\{User name}\Start Menu\Programs\Startup.)

Backdoor Routine

This backdoor executes the following commands from a remote malicious user:

• Steal information from a browser
• Open a browser and load a specific page
• Run a Tor service
• Download and execute file
• Update itself
• Perform DDOS attack
• Serves as a SOCKS proxy server

It connects to the following URL(s) to send and receive commands from a remote malicious user:

• http://{BLOCKED}.{BLOCKED}.101.90/solar/index.php

However, as of this writing, the said sites are inaccessible.

Information Theft

This backdoor gathers the following data:

• User name
• Computer name
• OS version
• System type (whether running on a 32-bit or 64-bit system)

Stolen Information

This backdoor sends the gathered information via HTTP POST to the following URL:

• http://{BLOCKED}.{BLOCKED}.101.90/solar/index.php?v={malware version}&u={user name}&c={computer name}&s={unique identifier}&w={OS version}&b={system type}

NOTES:

This backdoor creates the following named pipe:

• \\.\pipe\napSolar

It runs a Tor service by dropping the following files:

• %Application Data%\tor.bin
• %Application Data%\torrc

It hooks APIs.

With its rootkit functionality, it can block changes to the following registry keys:

Microsoft\Windows\CurrentVersion\Run
Microsoft\Windows NT\CurrentVersion\Windows\run
Microsoft\Windows NT\CurrentVersion\Windows\load
Microsoft\Windows\CurrentVersion\Policies\Explorer\run
Microsoft\Windows NT\CurrentVersion\Winlogon
Microsoft\Active Setup\Installed Components