arrow_back
search
close

BKDR_VAWTRAK.YVH

April 28, 2014
 Analysis by: Alvin John Nieto
 ALIASES:

Trojan-PSW.Win32.Tepfer.tttf (Kaspersky), Backdoor:Win32/Vawtrak.D (Microsoft), Win32/PSW.Papras.DC trojan (ESET)

 PLATFORM:

Windows 2000, Windows Server 2003, Windows XP (32-bit, 64-bit), Windows Vista (32-bit, 64-bit), Windows 7 (32-bit, 64-bit)

 OVERALL RISK RATING:
 DAMAGE POTENTIAL:
 DISTRIBUTION POTENTIAL:
 REPORTED INFECTION:

  • Threat Type: Backdoor

  • Destructiveness: No

  • Encrypted:

  • In the wild: Yes

  OVERVIEW


This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

  TECHNICAL DETAILS

File Size:

227,784 bytes

File Type:

DLL

Initial Samples Received Date:

24 Apr 2014

Arrival Details

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Autostart Technique

This backdoor adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
{malware name} = "regsvr32.exe "{malware path}\{malware name}.{file extension}""

Other System Modifications

This backdoor adds the following registry entries:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows\Safer\
CodeIdentifiers
PolicyScope = "0"

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Main
NoProtectedModeBanner = "1"

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Main
TabProcGrowth = "0"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings\
Zones\3
2500 = "3"

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows\Safer\
CodeIdentifiers
DefaultLevel = "262144"

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows\Safer\
CodeIdentifiers
TransparentEnabled = "1"

Other Details

This backdoor connects to the following possibly malicious URL:

  • http://{BLOCKED}onally.com/forumdisplay.php?fid={value}
  • http://{BLOCKED}ilix.com/forumdisplay.php?fid={value}
  • http://{BLOCKED}ag.com/forumdisplay.php?fid={value}
  • http://{BLOCKED}old.com/forumdisplay.php?fid={value}
  • http://{BLOCKED}oxon.com/forumdisplay.php?fid={value}
  • http://{BLOCKED}5.{BLOCKED}.32.67/forumdisplay.php?fid={value}
  • http://{BLOCKED}5.{BLOCKED}.32.80/forumdisplay.php?fid={value}
  • http://{BLOCKED}6.{BLOCKED}5.233.38/forumdisplay.php?fid={value}
  • http://{BLOCKED}olon.com/{BLOCKED}mdisplay.php?fid={value}
  • http://{BLOCKED}6.{BLOCKED}5.233.80/forumdisplay.php?fid={value}
  • http://{BLOCKED}diaz.com/{BLOCKED}display.php?fid={value}
  • http://{BLOCKED}ilpane.com/{BLOCKED}display.php?fid={value}