BKDR_PROXY.TORYE

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It enables its automatic execution at every system startup by dropping copies of itself into the Windows Common Startup folder.

It does not have any propagation routine.

It executes commands from a remote malicious user, effectively compromising the affected system.

It does not have any information-stealing capability.

Arrival Details

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This backdoor drops the following copies of itself into the affected system and executes them:

• %User Temp%\RarSFX0\crssv.exe

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.)

It drops the following component file(s):

• %User Temp%\RarSFX0\sato.docx

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.)

It creates the following folders:

• %User Temp%\RarSFX0

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.)

Autostart Technique

This backdoor enables its automatic execution at every system startup by dropping the following copies of itself into the Windows Common Startup folder:

• %Start Menu%\Programs\Startup\nvvscv.exe

(Note: %Start Menu% is the current user's Start Menu folder, which is usually C:\Windows\Start Menu or C:\Documents and Settings\{User name}\Start Menu on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming\Microsoft\Windows\Start Menu on Windows Vista and 7.)

It modifies the following registry entries to ensure it automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Winlogon
Userinit = "%System%\userinit.exe,%User Temp%\RarSFX0\crssv.exe,"

(Note: The default value data of the said registry entry is "%System%\userinit.exe,".)

Propagation

This backdoor does not have any propagation routine.

Backdoor Routine

This backdoor executes the following commands from a remote malicious user:

• Download and execute arbitrary files
• Use proxy server settings of current user

It connects to the following URL(s) to send and receive commands from a remote malicious user:

• http://www.{BLOCKED}shalom.com/blog/_vti_bin/index.php

As of this writing, the said sites are inaccessible.

Information Theft

This backdoor does not have any information-stealing capability.

Other Details

This backdoor connects to the following URL(s) to check for an Internet connection:

• http://www.microsoft.com
• http://www.msftncsi.com
• http://www.yahoo.co.jp

NOTES:

It does not have rootkit capabilities.

It does not exploit any vulnerability.