BKDR_POISON.BGZ

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It does not have any propagation routine.

It opens a hidden Internet Explorer window. However, as of this writing, the said sites are inaccessible.

It does not drop any other file.

It does not have any downloading capability.

It deletes the initially executed copy of itself.

Arrival Details

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This backdoor drops the following copies of itself into the affected system:

• %System%\msfullcomen.exe

(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.)

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• KDKD&^*#F

Autostart Technique

This backdoor adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Active Setup\Installed Components\{343F94C0-7BF8-95A0-9892-DE5C539F2AF8}
StubPath = "%System%\msfullcomen.exe"

Other System Modifications

This backdoor adds the following registry keys:

HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications

Propagation

This backdoor does not have any propagation routine.

Backdoor Routine

This backdoor opens the following port(s) where it listens for remote commands:

• TCP port 443

It opens a hidden Internet Explorer window.

It connects to the following URL(s) to send and receive commands from a remote malicious user:

• {BLOCKED}i.zyns.com

However, as of this writing, the said sites are inaccessible.

Dropping Routine

This backdoor does not drop any other file.

Download Routine

This backdoor does not have any downloading capability.

Other Details

Based on analysis of the codes, it has the following capabilities:

• Capture screen, audio, and webcam
• Key logger
• List active ports
• Manage open windows
• Manage passwords
• Manage registry, processes, services, devices, and installed applications
• Perform multiple simultaneous transfers
• Perform remote shell
• Relay server
• Searh files
• Share servers
• Update, restart, terminates itself

It deletes the initially executed copy of itself

NOTES:

This backdoor does not have rootkit capabilities.

This backdoor does not exploit any vulnerability.