BKDR_PROXY.XTQ

This backdoor may be dropped by other malware.

It does not have any propagation routine.

It executes commands from a remote malicious user, effectively compromising the affected system. However, as of this writing, the said sites are inaccessible.

Arrival Details

This backdoor may be dropped by the following malware:

• TROJ_DROPPER.XTR

Installation

This backdoor drops and executes the following files:

• %Windows%\Tasks\conime.exe - also detected as BKDR_PROXY.XTQ

(Note: %Windows% is the Windows folder, which is usually C:\Windows.)

Autostart Technique

This backdoor adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
taskday = "%Windows%\tasks\conime.exe"

Propagation

This backdoor does not have any propagation routine.

Backdoor Routine

This backdoor executes the following commands from a remote malicious user:

• Execute files
• Perform remote shell
• Sleep for a specified amount of time
• Download file from C&C server
• Uninstall itself from affected machine

It connects to the following URL(s) to send and receive commands from a remote malicious user:

• http://{BLOCKED}013.{BLOCKED}u.com/a.asp?id={Encrypted Information}{Date and Time of Connection}
• http://{BLOCKED}013.{BLOCKED}w.us/a.asp?id={Encrypted Information}{Date and Time of Connection}
• http://{BLOCKED}hristmas.{BLOCKED}s.info/grc/index.asp?id={Encrypted Information}{Date and Time of Connection}

It posts the following information to its command and control (C&C) server:

• Computer Name
• Local IP Address
• Proxy Server IP and Port
• Malware ID

However, as of this writing, the said sites are inaccessible.

Download Routine

This backdoor saves the files it downloads using the following names:

• %User Temp%\temps.ini

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.)

Information Theft

This backdoor gathers the following data:

• Malware ID
• Computer Name
• Local IP Address
• Proxy Server IP and Port

NOTES:

Where {Encrypted Information} contains encrypted Malware ID, Computer Name, Local IP Address and Proxy Server and IP Port. {Date and time of connection} is {Day}%20{Month}%20{Day of Month}%20{Hours:Minutes:Seconds}{Year}.

It does not have rootkit capabilities.

It does not exploit any vulnerability.