BKDR_POSTBOT.SM

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It does not have any propagation routine.

It executes commands from a remote malicious user, effectively compromising the affected system.

Arrival Details

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This backdoor adds the following mutexes to ensure that only one of its copies runs at any one time:

• swdk1wgs5dre

Other System Modifications

This backdoor adds the following registry entries:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer
MMID = "{random value}"

Propagation

This backdoor does not have any propagation routine.

Backdoor Routine

This backdoor executes the following commands from a remote malicious user:

• Enumerate all drives with corresponding drive types
• Enumerate files and directories
• Copy, move, rename, or delete files
• Create directories
• Create or terminate processes
• Copy %System%\cmd.exe as %User Temp%\ms38340fhgs.exe
• Perform remote shell
• Upload files to C&C server
• Download files from C&C server
• Execute the file %System%\msvid.exe with the parameter /u
• Execute the file %System%\msvid.exe with the parameter /g
• Sleep for a specified amount of time

(Note: %User Temp% is the user's temporary folder, where it usually is C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local\Temp on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

It connects to the following URL(s) to send and receive commands from a remote malicious user:

• {C&C domain name}/{8 random characters}{hard-coded string}
  where {hard-coded string} can be any of the following:
  • 815.php
  • 91b.php
  • 082.php
  • 45f.php
  • 682.php
  • 739.php
  • d93.php
  • eb4.php
  • f27.php
  • 1bc.php
  • 2da.php
  • 3e6.php
  • 472.php
  • 5c2.php
  • 617.php
  • 7f8.php
  • a26.php
  • 292.php
  • 3a2.php
  • c19.php
  • 18c.php
  • 51d.php

Download Routine

This backdoor saves the files it downloads using the following names:

• %System%\msvid.exe

(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.)

NOTES:

This backdoor may use proxy connections by connecting to the following URL:

• {Proxy server name}:{Port Number}

The proxy server name and port number depends on the following file:

• {malware path}\conf.ini

It accesses the following URL to read its configuration:

• http://{BLOCKED}yu.xsrv.jp/default.php

Its configuration contains the C&C domain name information. However, as of this writing, the said URL is already inaccessible.

It does not have rootkit capabilities.

It does not exploit any vulnerability.