Backdoor.MSIL.REMCOS.JCASNR

This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes commands from a remote malicious user, effectively compromising the affected system. However, as of this writing, the said sites are inaccessible.

Arrival Details

This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Backdoor drops the following copies of itself into the affected system:

• %Application Data%\fope.exe

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It drops the following files:

• %Application Data%\GTX-Vidia\logs.dat → record of user keystrokes
• %User Temp%\install.vbs
• %User Temp%\update.vbs

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It adds the following processes:

• "cmd.exe" /C schtasks /create /sc minute /mo 1 /tn "Nafdnasia" /tr %Application Data%\fope.exe /f
• "cmd.exe" /C copy "{Malware File Path}\{Malware File Name}.exe" "%Application Data%\fope.exe"
• %Windows%\Microsoft.NET\Framework\{.NET Version}\RegAsm.exe

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %Windows% is the Windows folder, where it usually is C:\Windows on all Windows operating system versions.)

It creates the following folders:

• %Application Data%\GTX-Vidia

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• Mutex_RemWatchDog
• ewi742dnd-7CE5YY

It injects codes into the following process(es):

• %Windows%\Microsoft.NET\Framework\{.NET Version}\RegAsm.exe

(Note: %Windows% is the Windows folder, where it usually is C:\Windows on all Windows operating system versions.)

Other System Modifications

This Backdoor adds the following registry entries:

HKEY_CURRENT_USER\Software\ewi742dnd-7CE5YY
exepath = {hex values}

HKEY_CURRENT_USER\Software\ewi742dnd-7CE5YY
licence = {hex values}

Backdoor Routine

This Backdoor executes the following commands from a remote malicious user:

• Open and close camera
• Start and stop keylogger
• Download files
• Upload files
• Delete files
• Rename files
• Enumerate files
• Execute files
• Browse directory
• Delete directory
• Play, pause, and stop an alarm
• Play, pause, stop, and record audio
• Change desktop wallpaper
• Enumerate running processes
• Execute cmd.exe
• Manage services (Create, Enumerate, Modify, Start, Stop, and Delete)
• Manage registry keys and entries (Create, Enumerate, Modify, and Delete)
• Bypass UAC to escalate its privileges in the victim machine
• Restarts the affected machine
• Sleeps the affected machine
• Logs off the affected machine
• Shutdown the affected machine
• Create image
• Screen capture user's desktop
• Set, copy, and clear clipboard data
• Retrieve and clear login data and cookies from the following web browsers:
  • Chrome
  • Firefox
  • Internet Explorer
• Display a message box
• Maximize/minimize application
• Get active program's window title
• Add, modify, or delete an icon from the taskbar's status area

It connects to the following URL(s) to send and receive commands from a remote malicious user:

• coman-n.{BLOCKED}s.org:30288

However, as of this writing, the said sites are inaccessible.

Information Theft

This Backdoor gathers the following data:

• User Name
• Computer Name
• Product Name
• Windows Architecture
• User Keystrokes
• Locale Information
• User Privileges (User or Administrator)
• Clipboard Data
• Keyboard Input
• User Activity (Idle Time)
• Mouse Activity
• Memory Information
• System Drive Information

Other Details

This Backdoor adds the following scheduled tasks:

• Name: Nafdnasia
  Trigger: After triggered, repeat every 00:01:00 indefinitely
  Action: Start a program %Application Data%\fope.exe

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)