BKDR_GRAVITYRAT.D

This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It connects to a website to send and receive information.

Arrival Details

This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Backdoor creates the following folders:

• %AppDataLocal%\LSASS
• %AppDataLocal%\LSASS\1.exe_Url_{Random Characters}
• %AppDataLocal%\LSASS\Information
• %AppDataLocal%\LSASS\Storage

(Note: %AppDataLocal% is the Application Data folder found in Local Settings, where it is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• LSASS

Autostart Technique

This Backdoor drops the following files:

• %AppDataLocal%\LSASS\1.exe_Url_5{Random Characters}\1.9.1201.10\userconfig.xml

(Note: %AppDataLocal% is the Application Data folder found in Local Settings, where it is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

Backdoor Routine

This Backdoor connects to the following websites to send and receive information:

• http://{BLOCKED}.{BLOCKED}pdates.com:46769/GX/GX-Server.php
• http://{BLOCKED}.{BLOCKED}pdates.com:46769/GX/GX-Server.php
• http://{BLOCKED}.{BLOCKED}pdates.com:46769/GX/GX-Server.php
• http://{BLOCKED}.{BLOCKED}pdates.eu:46769/GX/GX-Server.php
• http://{BLOCKED}.{BLOCKED}pdates.eu:46769/GX/GX-Server.php
• http://{BLOCKED}.{BLOCKED}pdates.eu:46769/GX/GX-Server.php

Information Theft

This Backdoor gathers the following data:

• It gathers the following user account information of the affected system:
  • Account Type
  • Caption
  • Description
  • Disabled
  • Domain
  • Full Name
  • Local Account
  • Lockout
  • Name
  • Password Changes
  • Password Expiration
  • Password
  • SID
  • SID Type
  • Status
• Open Ports on the Victim Host
• List of all Running Processes
• List of all available services on the system
• MAC Address
• OS Version
• Computer Name
• IP Address
• Fingerprint - Generated MD5 hash using the information gathered in the affected system
• Files with the following extensions in fix and removable drives:
  • .docx
  • .doc
  • .pptx
  • .ppt
  • .xlsx
  • .xls
  • .rtf
  • .pdf
• Processor ID
• Processor Name
• Manufacturer of Processor
• CPU Temperature

Other Details

This Backdoor does the following:

• It is capable of file encryption
  • Encryption Key: "lolomycin2017"
• It uses several Anti Virtualization techniques:
  • Searches for any additional tools used by the Hypervisor (a program installed on Virtual Machine) if it is installed on the system by checking a registry key:
    • SOFTWARE\Microsoft\Virtual Machine\Guest\Parameters
  • It creates a WMI query to the Win32_BIOS entry. If the response contains the following, the malware is considered to be in a Virtual Machine
    • VMware
    • Virtual
    • XEN
    • Xen
    • A M I
  • This malware creates a query to the Win32_Computer entry in WMI. It checks if the manufacturer has the following response to be considered running in a Virtual Machine:
    • VIRTUAL
    • VMWARE
    • VirtualBox
  • It checks if it uses a processor id of Virtual Machine
  • Performs a search for the value of the Cpu TEMP, if the response is "Not supported", it means that it runs on a Virtual Machine.
  • Searches for the following MAC Addresses that is used by a Virtual Machine:
    • 00:50:56 / VMware, Inc.
    • 00:0C:29 / VMware, Inc.
    • 00:05:69 / VMware, Inc.
    • 08:00:27 / PCS Systemtechnik GmbH (VirtualBox)
    • 00:1C:42 / Parallels, Inc
  • Checks on how many cores does the system have. If one, it is flagged as being run on a Virtual Machine