BKDR_POISON.BQA

This backdoor has received attention from independent media sources and/or other security firms.

To get a one-glance comprehensive view of the behavior of this Backdoor, refer to the Threat Diagram shown below.

This backdoor arrives as an attachment to email messages spammed by other malware/grayware or malicious users.

It opens a hidden Internet Explorer window. It executes a file that contains several commands intended to perform different routines on the affected system.

It deletes itself after execution.

Arrival Details

This backdoor arrives as an attachment to email messages spammed by other malware/grayware or malicious users.

Installation

This backdoor drops the following copies of itself into the affected system:

• %System%\senr32.exe

(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.)

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• )!VoqA.jg

It stays resident in memory by creating the following process(es):

• iexplore.exe

Autostart Technique

This backdoor adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Active Setup\Installed Components\{1E703D92-FC88-919B-8C49-CD2B354F1E44}
StubPath = %System%\senr32.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
System Error Notification = %System%\senr32.exe

Backdoor Routine

This backdoor opens a hidden Internet Explorer window.

It executes a file that contains several commands intended to perform different routines on the affected system.

Other Details

This backdoor deletes itself after execution.