BKDR_PUSHDO.SM

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes commands from a remote malicious user, effectively compromising the affected system. It connects to a website to send and receive information.

Arrival Details

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This backdoor drops the following copies of itself into the affected system:

• %User Profile%\{random filename}.exe

(Note: %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003, or C:\Users\{user name} on Windows Vista and 7.)

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• {random filename}

Autostart Technique

This backdoor adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
{random filename} = "%User Profile%\{random filename}.exe"

Other System Modifications

This backdoor adds the following registry entries as part of its installation routine:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion
AppManagement = "{random values}"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion
{random filename}zap = "{random values}"

Propagation

This backdoor uses any of the following Simple Mail Transfer Protocol (SMTP) servers:

• smtp.compuserve.com
• mail.airmail.net
• smtp.directcon.net
• smtp.sbcglobal.yahoo.com
• smtp.mail.yahoo.com
• smtp.live.com

Backdoor Routine

This backdoor executes the following commands from a remote malicious user:

• Download and execute files
• Retrieve Spam Configuration/Content
• Get OS Version
• Get System Information
• Get Network Information

It connects to the following websites to send and receive information:

• {BLOCKED}ta.org

NOTES:

It performs random GET Request connection to the following URLs to mask outbound connections:

• 0daymusic.biz
• 0kommanix.de
• 0kommanix.de
• 0risiko.de
• 4-elements.ch
• 4-elements.ch
• 4-elements.ch
• 4darabians.nl
• 4darabians.nl
• 4dbabamozi.hu
• 4dbabamozi.hu
• 4dbabamozi.hu
• 4dbenelux.be
• 4dbenelux.be
• 4effect.ca
• 4egolifestyle.de
• 4elementos.cl
• 4elements.cz
• 4elements.hu
• 4elements.pl
• 4emails.de
• 4emotion.pl
• 4enerchi.nl
• 4energia.ee
• 4ernila.de
• 4erotik.de
• 4erotik.de
• 4esport.de
• 4estates.eu
• 4ever-hosting.de
• 4ever4you.de
• 4everandever.de
• 4everevents.nl
• 4everkids.de
• 4evernails.nl
• 4every1.cc
• 4every1.cc
• 4everything.pl
• 8wellesley.ca
• 8zaamarchitecten.nl
• 8zaamarchitecten.nl
• 8zaamarchitecten.nl
• 9online.fr
• 9t6grafikdesign.de
• 9welten.de
• accountingtechs.biz
• accountingtechs.biz
• accountingtechs.biz
• accounting.ee
• accounting.ee

It performs random POST Request connection to the following URLs to mask outbound connections. It may also randomly add the URI /?ptrxcz_{random} to domains below:

• abv.bg
• actuslendlease.com
• adt.com
• aeroinc.net
• alice-dsl.de
• allstate.com
• allstate.com
• aol.com.com
• apollo.lv
• atkearney.com
• atkearney.com
• backaviation.com
• backpacker.com
• bailliegifford.com
• bailliegifford.com
• bassettfurniture.com
• birds.com
• birds.com
• boardermail.com
• bol.com.br
• brick.net
• btopenworld.com
• buffalo.edu
• bumbleandbumble.com
• bumbleandbumble.com
• cablelynx.com
• cablelynx.com
• cableone.net
• cableone.net
• caionline.org
• cancun.com.mx
• cannylink.com
• cantv.net
• capecod.net
• caramail.com
• carolina.com
• catech-systems.com
• centurytel.net
• chat4all.org
• chickensys.com
• clarksville.com
• cnet.com
• col.com
• comcast.net
• comporium.net
• connections-etc.net
• connections-etc.net
• correoweb.com
• cox.com
• cox.net
• croeso.com
• crosspaths.net
• dadlnet.dk
• diamondcpu.com
• diamondcpu.com
• diamondcpu.com
• dicksmail.com
• dr.dk
• dragonmount.com
• dsl.com
• eastlink.ca
• eastlink.ca
• enter.net
• excite.co.jp
• excite.co.uk
• excite.co.uk
• excite.fr
• eznet.net
• frg.eur.nl
• gallatinriver.net
• gallatinriver.net
• gmx.at
• grayfoot.mailshell.com
• happemail.com
• happyhippo.com
• hotmaik.com
• hotmale.com
• hotmiail.com
• idealcollectables.com
• imaginet.com
• in.com
• intuit.com
• iowatelecom.net
• iupui.edu
• iw.com
• iw.com
• juno.net
• karoo.co.uk
• kettering.edu
• kettering.edu
• laposte.net
• machlink.com
• madasfish.com
• mania.com
• mania.com
• marchmail.com
• merck.com
• merck.com
• metallica.com
• metrocast.net
• military.com
• military.com
• mindspring.com
• models.com
• mountainmax.net
• mountainmax.net
• mountainmax.net
• msn.net
• music.com
• musician.org
• mweb.co.za
• myway.com
• nau.edu
• ncable.net.au
• ncable.net.au
• nccn.net
• neobright.net
• netscape.com
• netscape.net
• nifty.com
• ninemsn.com.au
• ninemsn.com.au
• nsatel.net
• o2.co.uk
• oakwood.org
• olemiss.edu
• onebox.com
• ono.com
• ono.es
• oregonstate.edu
• planttel.net
• plasa.com
• popstar.com
• posten.se
• potamkinmitsubishi.com
• primeline.com
• primusonline.com.au
• proftools.lt
• pru-nw.com
• quixnet.net
• redlands.edu
• reihtec.com
• reihtec.com
• robvivian.com
• robvivian.com
• rz-online.de
• rz-online.de
• schoolsports.com
• sexstories.com
• sify.com
• sky.com
• skynet.be
• sol.dk
• spin.com
• spray.se
• spray.se
• sscomputing.com
• start.no
• stupid.com
• su.edu
• suscom.net
• sympatico.com
• t-mobel.com
• tartarus.uwa.edu.au
• terra.cl
• terra.com.br
• the-beach.net
• tigers-net.com
• tinet.org
• tiscali.co.uk
• trib.com
• tylerknott.com
• uakron.edu
• uakron.edu
• ufl.edu
• ufl.edu
• und.edu
• univision.com
• vail.com
• vaxxine.com
• verizon.net
• verizon.net
• verizon.net
• virginia.edu
• vol.com
• vol.com
• vwr-inc.com
• wa-net.com
• wagged.com
• waupacafoundry.com
• wildmail.com
• world-net.co.nz
• www.optonline.com
• x-men.com
• x-men.com
• yahoo.co.jp
• yahoo.com.cn
• zdnetonebox.com
• zeelandnet.nl
• zueliya.com

The sent OS Version information is any of the following format:

• UndefinedOS
• Vista
• Win2K
• Win7
• Win8
• WinHomeServer
• WinServer2003R2
• WinServer2008
• WinServer2003
• WinServer2012
• WinServer2008R2
• WinXP
• WinXP64