Backdoor.Win64.ANCHOR.A

This is the Trend Micro detection for the backdoor installed by the PowerTrick post-exploitation toolkit believed to be developed by creators of Trickbot.

This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It connects to certain websites to send and receive information.

Arrival Details

This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Backdoor drops and executes the following files:

• {Malware Path}\{Malware Name}.exe:$FILE → contains {Malware Path}\{Malware Name}.exe
• {Malware Path}\{Malware Name}.exe:$GUID → contains /anchor_dns/{Workstation Name}_{Windows Version}.<{32-character long client ID}>/[0-1]/{Content}\xb[0-9]
• {Malware Path}\{Malware Name}.exe:$TASK → contains "{string1} autoupdate#{5 Random Numbers}.xml"
  
  • {string1} can be any of the folders found on %Application Data%
• "{string1} autoupdate#{5 Random Numbers}".xml → a task scheduler that executes the malware sample with parameter -u every fifteenth minute

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

Other Details

This Backdoor connects to the following website to send and receive information:

• {Obfuscated Message Type + UUID}{Content}.{BLOCKED}ivo.com
  
  • where Message Type can be any of the following:
    
    • Type 0 (Sending of Data)
    • Type 1 (Preparation for receival of Data)
    • Type 2 (Receiving of Data)

It adds the following scheduled tasks:

• Task Name: {string1} autoupdate#{5 Random Numbers}
• Trigger: At log on of any user; At 8:38PM every day for every 15 minutes for a duration of 1 day. Both trigger expires at 12/31/2028 11:59:59PM
• Action: Starts a program → %User Temp%\{Malware Name}.exe -u
  
  • -u will perform standard communication with C2 server using subdomain names to send data and resolved IPs as receival of data

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)