BKDR_FUCOBHA.AW

This backdoor may be dropped by other malware.

It does not have any propagation routine.

It executes commands from a remote malicious user, effectively compromising the affected system.

As of this writing, the said sites are inaccessible.

Arrival Details

This backdoor may be dropped by the following malware:

• TROJ_MDROPR.AW

Installation

This backdoor drops the following component file(s):

• %Program Files%\Internet Explorer\sxs.dll - also detected as BKDR_FUCOBHA.AW

(Note: %Program Files% is the default Program Files folder, usually C:\Program Files in Windows 2000, Server 2003, and XP (32-bit), Vista (32-bit), and 7 (32-bit), or C:\Program Files (x86) in Windows XP (64-bit), Vista (64-bit), and 7 (64-bit).)

Propagation

This backdoor does not have any propagation routine.

Backdoor Routine

This backdoor executes the following commands from a remote malicious user:

• Download Files
• Upload Files
• Execute Files
• Perform Remote Shell

It connects to the following URL(s) to send and receive commands from a remote malicious user:

• www.{BLOCKED}layers.com/jd/upload.aspx?filepath=info&filename{Host Name}_{Local IP Address}.jpg
• www.{BLOCKED}layers.com/jd/upload.aspx?filepath=ok&filename={Host Name}_{Local IP Address}.jpg

Download Routine

This backdoor accesses the following websites to download files:

• www.{BLOCKED}ayers.com/jd/order/{Host Name}_{Local IP Address}.jpg

It saves the files it downloads using the following names:

• %User Temp%\order.dat

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.)

As of this writing, the said sites are inaccessible.

Information Theft

This backdoor gathers the following data:

• Host Name
• Local IP Address
• Proxy Server (if any)
• Currently logged on user name
• System directory
• OS and System Version
• List of active processes in the machine

Stolen Information

This backdoor saves the stolen information in the following file:

• %User Temp%\tmp.dat

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.)

It sends the gathered information via HTTP POST to the following URL:

• www.{BLOCKED}layers.com/jd/upload.aspx?filepath=info&filename{Host Name}_{Local IP Address}.jpg
• www.{BLOCKED}layers.com/jd/upload.aspx?filepath=ok&filename={Host Name}_{Local IP Address}.jpg

NOTES:
This Trojan deletes %User Temp%\tmp.dat after the stolen information is sent.

It does not have rootkit capabilities.

It does not exploit any vulnerability.