BKDR_COBEACON.B

This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It opens random ports. It executes commands from a remote malicious user, effectively compromising the affected system.

Arrival Details

This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Backdoor drops the following files:

• %User Temp%\_MEI2802\Crypto.Cipher._AES.pyd
• %User Temp%\_MEI2802\MSVCR100.dll
• %User Temp%\_MEI2802\_bz2.pyd
• %User Temp%\_MEI2802\_ctypes.pyd
• %User Temp%\_MEI2802\_hashlib.pyd
• %User Temp%\_MEI2802\_lzma.pyd
• %User Temp%\_MEI2802\_socket.pyd
• %User Temp%\_MEI2802\_ssl.pyd
• %User Temp%\_MEI2802\df_newc2_stageless.exe.manifest
• %User Temp%\_MEI2802\pyexpat.pyd
• %User Temp%\_MEI2802\python34.dll
• %User Temp%\_MEI2802\select.pyd
• %User Temp%\_MEI2802\unicodedata.pyd
• %User Temp%\_MEI2802\Include\pyconfig.h
• %User Temp%\_MEI2802\base_library.zip

(Note: %User Temp% is the user's temporary folder, where it usually is C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local\Temp on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

It creates the following folders:

• %User Temp%\_MEI2802
• %User Temp%\_MEI2802\Include

(Note: %User Temp% is the user's temporary folder, where it usually is C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local\Temp on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

Backdoor Routine

This Backdoor opens a random port to allow a remote user to connect to the affected system. Once a successful connection is established, the remote user executes commands on the affected system.

It executes the following commands from a remote malicious user:

• Set sleep time
• Execute shell command
• Execute PowerShell command using Powershell
• Execute PowerShell cmdlets without powershell.exe
• Execute PowerShell command by injecting to a specific process
• Execute command from a specific directory
• Spawn session for listener
• Spawn specific architecture and full path to a program to spawn
• Inject a session into a specific process
• Inject a 64-bit version of malware to a 64-bit process
• Inject Reflective DLL into a process
• Inject a shellcode from a local file into a specific process
• Inject a shellcode into a spawned process
• Assign alternate parent process
• Execute command with another process as the parent
• Spawn a session with another process as the parent
• Download file/s
• Display files currently being downloaded
• Upload file/s
• List files in current directory
• Create new folder
• Delete file/folder
• Copy file/s
• Move file/s
• Log keystrokes
• Take screenshots
• Display currently executing backdoor command
• Terminate currently executing backdoor command
• Setup SOCKS4a proxy server
• Setup reverse pivot
• Disable reverse port forward
• List privilege escalation exploits
• Perform exploit to elevate privilege
• Execute command using known credentials
• Spawn session using known credentials
• Impersonate a token for the SYSTEM account
• Spawn a session in a process with elevated rights
• Enable privileges assigned to current access token
• Execute Mimikatz to recover user logon passwords
• Scan ports
• Enumerate network and hosts
• Impersonate a token from an existing process
• Inject a Kerberos ticket into the current session
• Execute a payload on a remote host
• Execute a payload on a remote host using PowerShell
• Execute a payload on a remote host using WinRM
• Deliver payload via Windows Management Instrumentation
• Terminate itself
• Terminate a process
• Modify timestamps

It connects to the following URL(s) to send and receive commands from a remote malicious user:

• https://rcb{BLOCKED}pspot.com/___utm.gif?utmac=UA-2202604-2&utmcn=1&utmcs=ISO-8859-1&utmsr=1280x1024&utmsc=32-bit&utmul=en-US

As of this writing, the said servers are currently inaccessible.

Other Details

This Backdoor connects to the following URL(s) to check for an Internet connection:

• http://www.google.com:443
• http://mail.google.com:443
• http://docs.google.com:443