BKDR_ALINA.POSKAT

This is the detection for the Katrina point-of-sale (PoS) malware.

To get a one-glance comprehensive view of the behavior of this Backdoor, refer to the Threat Diagram shown below.

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes commands from a remote malicious user, effectively compromising the affected system.

Arrival Details

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This backdoor drops the following copies of itself into the affected system and executes them:

• %Application Data%\usercache\{file name}.exe

(Note: %Application Data% is the Application Data folder, where it usually is C:\Documents and Settings\{user name}\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Roaming on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

It drops the following files:

• %Application Data%\bootstrap - encrypted copy of itself

(Note: %Application Data% is the Application Data folder, where it usually is C:\Documents and Settings\{user name}\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Roaming on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

Autostart Technique

This backdoor adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Microsoft\Windows\
CurrentVersion\Run
{file name} = "%Application Data%\usercache\{file name}.exe

Other System Modifications

This backdoor adds the following registry keys:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
DownloadManager

It adds the following registry entries as part of its installation routine:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion
identifier = "{random 6 letters}"

Backdoor Routine

This backdoor executes the following commands from a remote malicious user:

• Update itself
• Change interval of update requests
• Change interval of card data exfiltration
• Enable/Disable logging
• Download and execute other malware

It connects to the following URL(s) to send and receive commands from a remote malicious user:

• http://www.{BLOCKED}es777.ru/x1/settings.php

Download Routine

This backdoor connects to the following website(s) to download and execute a malicious file:

• http://{BLOCKED}.{BLOCKED}.178.109/file/32.exe - detected as TSPY_POSNEWT.B
• http://{BLOCKED}.{BLOCKED}.178.109/file/64.exe - detected as TSPY64_POSNEWT.B

It saves the files it downloads using the following names:

• %Application Data%\{random file name}.exe

(Note: %Application Data% is the Application Data folder, where it usually is C:\Documents and Settings\{user name}\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Roaming on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

NOTES:

It creates the following named pipe:

• \.\\pipe\Katrina{random 6 letters}

{file name} can be any of the following:

• svchost
• java
• jusched
• jucheck
• desktop
• adobeflash
• win-firewall
• dwm
• testing
• userinit
• windefender

It scans the memory of all running processes to retrieve card track data.

It skips to scan the following processes:

• AKW.exe
• QML.exe
• spoolsv.exe
• taskmgr.exe
• wscntfy.exe
• alg.exe
• winlogon.exe
• lsass.exe
• dllhost.exe
• services.exe
• pidgin.exe
• skype.exe
• thunderbird.exe
• devenv.exe
• steam.exe
• wininit.exe
• csrss.exe
• smss.exe
• iexplore.exe
• firefox.exe
• chrome.exe
• explorer.exe

It uses the following User-Agent:

• Mozilla/5.0 (Windows NT 6.1; WOW64; rv:5.0) Gecko/20100101 Firefox/5.0