BKDR_ENFAL

August 27, 2013

ALIASES:

Samsa, Samkams

PLATFORM:

Windows 2000, Windows Server 2003, Windows XP (32-bit, 64-bit), Windows Vista (32-bit, 64-bit), Windows 7 (32-bit, 64-bit)

OVERALL RISK RATING:

DAMAGE POTENTIAL:

DISTRIBUTION POTENTIAL:

REPORTED INFECTION:

Threat Type: Backdoor
Destructiveness: No
Encrypted:
In the wild: Yes

OVERVIEW

Infection Channel:

Downloaded from the Internet

ENFAL is a backdoor that is specifically used for downloading other malware. It is used in several targeted attacks.

ENFAL gathers system information such as the infected computer's MAC and IP addresses and operating system version. It then sends all gathered information to its command-and-control servers.

TECHNICAL DETAILS

Memory Resident:

Yes

Payload:

Connects to URLs/IPs

Installation

This backdoor drops the following copies of itself into the affected system:

%System%\AntNet.exe
%System%\DBGRID32.exe
%System%\DisMgnt.exe
%System%\NetInt.exe
%System%\Winkrnl.exe
%System%\dllcnfg.exe
%System%\dmgrd.exe
%System%\encapi.exe
%System%\win32.exe
%System%\winlog.exe

(Note: %System% is the Windows system folder, which is usually C:\Windows\System32.)

Autostart Technique

This backdoor modifies the following registry entries to ensure it automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Winlogon
Userinit = "%System%\userinit.exe,%System%\winlog.exe"