BKDR_AFCORE.SMA1

It opens a random port and waits for commands from a malicious attacker. Once a connection is established, it may perform several actions.

This backdoor may be downloaded by other malware/grayware/spyware from remote sites. It may be unknowingly downloaded by a user while visiting malicious websites.

It opens random ports. It executes commands from a remote malicious user, effectively compromising the affected system.

It deletes itself after execution.

Arrival Details

This backdoor may be downloaded by other malware/grayware/spyware from remote sites.

It may be unknowingly downloaded by a user while visiting malicious websites.

Installation

This backdoor drops the following component file(s):

• %System%\{random_name 1}.ocx - also detected as BKDR_AFCORE.SMA1
• %User Temp%\~~x{random number}.tmp - also detected as BKDR_AFCORE.SMA1

(Note: %System% is the Windows system folder, which is usually C:\Windows\System32.. %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.)

It drops the following non-malicious files:

• %System%\{random_name 1}.dat
• %System%\{random_name 2}.dat
• %System%\{random_name 3}.dat
• %System%\{random_name 4}.dat

(Note: %System% is the Windows system folder, which is usually C:\Windows\System32.)

Its DLL component is injected to the following process(es):

• explorer.exe

Autostart Technique

This backdoor adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CLASSES_ROOT\CLSID\{random CLSID}\
InprocServer32
@ = %System%\{random_name 1}.ocx

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\
ShellIconOverlayIdentifiers\{random_name 1}
@ = {random CLSID}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{random CLSID}\InprocServer32
@ = %System%\{random_name 1}.ocx

Backdoor Routine

This backdoor opens a random port to allow a remote user to connect to the affected system. Once a successful connection is established, the remote user executes commands on the affected system.

It executes the following commands from a remote malicious user:

• ADDTO
• DELCOOKIES
• DELFROM
• DISKFLOOD
• DISKUNFLOOD
• EXPORT
• IPHLP
• IPHLPA
• IPHLPF
• LISTCOOKIES
• LSTWND
• MULTICAST
• PERFRM
• RESOLVE
• RESPAWN
• RESTART
• RMOLD
• RUNDLL
• SETCOOKIE
• SETRADIUS
• SETRANGE
• SETSP
• SETSTR
• SETWND
• SHUTDOWN
• SPACE
• STATS
• UNFREEZE
• UNIFORG
• UNINSTALL

It connects to the following URL(s) to send and receive commands from a remote malicious user:

• http://{BLOCKED}u.realgoday.net/index.php

Other Details

This backdoor does the following:

• Checks if the following registry key is present upon installation. If not found, it extis from its code and does not perform its routines. HKEY_CLASSES_ROOT\.pif
• Performs the following action after connection is established:
  Shut down the machine
  Terminate processes
  Get IPC, log, and hook timeouts
  Open, create and delete files
  Initiate distributed denial of service (DDoS) flood attacks
  Scan logical drives
  Shutdown, Restart or Respawn itself
• Monitors applications(mostly web browsers) such as:
  iexplore.exe
  firefox.exe
  opera.exe
  skype.exe
• Gathers login information entered in websites with the following strings:
  answer
  challenge
  cross-border
  foreign
  memorable
  passphras
  password
  remittance
  s.w.i.f.t
  secret
  swift
  telegraphic

It deletes itself after execution.