BKDR_DAREMR.A

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It does not have any propagation routine.

It executes commands from a remote malicious user, effectively compromising the affected system. It connects to a website to send and receive information.

It does not have any downloading capability.

It retrieves specific information from the affected system.

Arrival Details

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This backdoor adds the following mutexes to ensure that only one of its copies runs at any one time:

• NamMuexObctSpeSp

Propagation

This backdoor does not have any propagation routine.

Backdoor Routine

This backdoor executes the following commands from a remote malicious user:

• Manage Files
• Manage Processes
• Manage Registries
• Manage Windows
• Perform Remote Shell

It connects to the following websites to send and receive information:

• host.{BLOCKED}c.com:1863

Dropping Routine

This backdoor drops the following files:

• %All Users Profile%\Start Menu\Programs\Startup\Internet Explorer.lnk

(Note: %All Users Profile% is the All Users or Common profile folder, which is C:\Documents and Settings\All Users in Windows 2000, XP, and Server 2003, and C:\ProgramData in Windows Vista and 7.)

Download Routine

This backdoor does not have any downloading capability.

Information Theft

This backdoor retrieves the following information from the affected system:

• OS Version
• Computer Name
• User Name
• Drive Information

NOTES:

This backdoor creates a shortcut file pointing to the malware itself.

It executes the following command:

C:\Windows\system32\cmd.exe /c
"C:\program files\common files\system\msadc\msdaremr.bat"

It does not have rootkit capabilities.

It does not exploit any vulnerability.