BKDR_POISON.HBJ
Windows 2000, Windows XP, Windows Server 2003
![](/vinfo/imgFiles/legend.jpg)
Threat Type: Backdoor
Destructiveness: No
Encrypted: Yes
In the wild: Yes
OVERVIEW
This backdoor may arrive contained inside a self extracting archive (RAR SFX) and attached in email messages. The SFX drops and executes this malware. The SFX also drops encrypted component files. Upon execution, it checks for the account user of the affected system if it has administrator rights. If it does, it copies itself to an alternate data stream (ADS) or as physical file in the %System% directory. It copies the encrypted component files. It stays memory resident by injecting codes in processes.It queries the default web browser by accessing a registry entry. It then launches a hidden web browser process (e.g. iexplore.exe). It then injects its code in the said process which contains its backdoor routines.
This backdoor arrives as an attachment to email messages spammed by other malware/grayware or malicious users.
TECHNICAL DETAILS
153,026 bytes
EXE
Yes
11 May 2011
Connects to URLs/IPs, Terminates processes, Modifies system registry, Captures screenshots
Arrival Details
This backdoor arrives as an attachment to email messages spammed by other malware/grayware or malicious users.
Installation
This backdoor adds the following mutexes to ensure that only one of its copies runs at any one time:
- lau's PI
Autostart Technique
This backdoor adds the following registry entries to enable its automatic execution at every system startup:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Active Setup\Installed Components\{8E12AADC-A55E-3FBE-4C6E-6B6EAC7CAFB5}
StubPath = "{malware path and file name}"
Backdoor Routine
This backdoor connects to the following URL(s) to send and receive commands from a remote malicious user:
- {BLOCKED}4.{BLOCKED}4.215.58
NOTES:
It may arrive contained inside a self extracting archive (RAR SFX) and attached in email messages.
The SFX drops and execute this malware as the following: %User Temp%\ie.exe
The SFX also drops the following encrypted component files: %User Temp%\loo.txt
It also drops and opens the following non-malicious document file to hide its malicious routines:
- %User Temp%\winword.doc
Upon execution, it checks for the account user of the affected system if it has administrator rights.
If it does, it copies itself to an alternate data stream (ADS) or as physical file in the %System% directory:
- %Windows%:adobeupdate.exe
If the user has no administrator rights, it copies itself as the following:
- %User Profile%\Application Data\adobeupdate.exe
It copies the encrypted component files as to the following:
- %Windows%\java\classes\ose.cer
- %Program Files%\Common Files\ODBC\Data Sources\Odbc.dat
It stays memory resident by injecting codes in the following process:
- Explorer.exe
Backdoor Routine
It queries the default web browser by accessing the following registry entry:
HKEY_CLASSES_ROOT\http\shell\open\command
It then launches a hidden web browser process (e.g. iexplore.exe). The malware then injects its code if the said process which contains its backdoor routines.
This backdoor has the following capabilities:
- Send system information (IP address, computer name, user name, operating system)
- Delete, search, and upload files
- Modify and search the registry entries
- Manage processes and services
- View and terminate active windows and ports
- Perform a shell command
- Download and inject remote codes to legitimate processes
- Log keystrokes and active window
- Capture screenshots
- View webcam activity
- Listen to microphone audio
- Update/uninstall the malware
SOLUTION
9.200
8.149.00
11 May 2011
Step 1
For Windows XP and Windows Server 2003 users, before doing any scans, please make sure you disable System Restore to allow full scanning of your computer.
Step 2
Restart in Safe Mode
Step 3
Delete this registry key
Important: Editing the Windows Registry incorrectly can lead to irreversible system malfunction. Please do this step only if you know how or you can ask assistance from your system administrator. Else, check this Microsoft article first before modifying your computer's registry.
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components
- {8E12AADC-A55E-3FBE-4C6E-6B6EAC7CAFB5}
- {8E12AADC-A55E-3FBE-4C6E-6B6EAC7CAFB5}
Step 4
Search and delete these files
- %User Temp%\loo.txt
- %User Temp%\winword.doc
- %Windows%\java\classes\ose.cer
- %Program Files%\Common Files\ODBC\Data Sources\Odbc.dat
Step 5
Restart in normal mode and scan your computer with your Trend Micro product for files detected as BKDR_POISON.HBJ. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check this Knowledge Base page for more information.
Did this description help? Tell us how we did.