BKDR_NEUTRINO.YN

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes commands from a remote malicious user, effectively compromising the affected system.

Arrival Details

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This backdoor drops the following copies of itself into the affected system and executes them:

• %Application Data%\{COMPUTER NAME}\{random file name}.exe

(Note: %Application Data% is the Application Data folder, where it usually is C:\Documents and Settings\{user name}\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Roaming on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

It creates the following folders:

• %Application Data%\{COMPUTER NAME}

(Note: %Application Data% is the Application Data folder, where it usually is C:\Documents and Settings\{user name}\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Roaming on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

Autostart Technique

This backdoor adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
{random file name}.exe = "%Application Data%\{COMPUTER NAME}\{random file name}.exe"

Other System Modifications

This backdoor adds the following registry keys:

HKEY_CURRENT_USER\Software\N3NNetwork

It adds the following registry entries:

HKEY_CURRENT_USER\Software\N3NNetwork
arr = "{random}="

HKEY_CURRENT_USER\Software\N3NNetwork
{random digits 1} = "0"

HKEY_CURRENT_USER\Software\N3NNetwork
{random digits 2} = "0"

HKEY_CURRENT_USER\Software\N3NNetwork
{random digits 3} = "0"

HKEY_CURRENT_USER\Software\N3NNetwork
{random digits 4} = "0"

HKEY_CURRENT_USER\Software\N3NNetwork
{random digits 5} = "0"

HKEY_CURRENT_USER\Software\N3NNetwork
rate = "5"

Backdoor Routine

This backdoor executes the following commands from a remote malicious user:

• Loads arbitrary file
• Find files
• Spread through removable drives
• Infect .RAR files
• Perform flood attacks (HTTP, SLOWLORIS, DOWNLOAD, TCP, UDP, SMART, HTTPS)
• Start keylogging routine
• Update itself
• Uninstall itself
• Perform remote shell
• Modify hosts file

It connects to the following URL(s) to send and receive commands from a remote malicious user:

• http://zx3a.{BLOCKED}i.me/zx3def/redir.php
• http://zx4b.{BLOCKED}i.me/zx3def/redir.php
• http://zx5c.{BLOCKED}i.me/zx3def/redir.php

Download Routine

This backdoor connects to the following website(s) to download and execute a malicious file:

• {BLOCKED}.{BLOCKED}.96.35/zx3def/16.exe
• {BLOCKED}.{BLOCKED}.96.35/zx3def/ss1.exe

It saves the files it downloads using the following names:

• %User Temp%{random digits}.exe

(Note: %User Temp% is the user's temporary folder, where it usually is C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local\Temp on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

Information Theft

This backdoor gathers the following data:

• User ID
• OS Version
• AV software installed
• NAT installed
• Product key

NOTES:

The randomly-named file may be any of the following:

• Alcmtr.exe
• alcwzrd.exe
• explroer.exe
• hh.exe
• HideWin.exe
• IsUninst.exe
• MicCal.exe
• notepad.exe
• regedit.exe
• RTDCPL.EXE
• RTHDCPL.exeE
• RTLCPL.exe
• RtlUpd.exe
• SkyTel.exe
• slrundll.exe
• SoundMan.exe
• TASKMAN.EXE
• twunk_16.exe
• twunk_32.exe
• winhelp.exe
• winhlp32.exe

This backdoor checks for the following:

• Debugger
• COMPUTER NAME contains the following strings:
  • MALTEST
  • TEQUILABOOMBOOM
  • SANDBOX
  • VIRUS
  • MALWARE
• Path of the file contains the following strings:
  • \SAMPLE
  • \VIRUS
  • SANDBOX
• If kernel32.dll exports the function wine_get_unix_file_name
• Loaded libraries:
  • sbiedll.dll
  • printfhelp.dll
  • api_log.dll
  • dir_watch.dll
  • pstorec.dll
  • vmcheck.dll
  • wpespy.dll
• If any of the following registries are present:
  • HKEY_LOCAL_MACHINE\SOFTWARE\VMWare, Inc.\VMare Tools
  • HKEY_LOCAL_MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions
• If the value of the following registry entries contains the strings VBOX, VIRTUALBOX, QEMU:
  • HKEY_LOCAL_MACHINE\HARDWARE\DEVICEMAP\Scsi\Scsi Port 0\Scsi Bus 0\Target Id 0\Logical Unit Id 0\Identifier
  • HKEY_LOCAL_MACHINE\HARDWARE\Description\System\SystemBiosVersion
  • HKEY_LOCAL_MACHINE\HARDWARE\Description\System\VideoBiosVersion

If any of the conditions is met, it terminates itself and displays an error message.