BKDR_PUDSHELL.B

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes commands from a remote malicious user, effectively compromising the affected system. However, as of this writing, the said sites are inaccessible.

Arrival Details

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This backdoor drops the following non-malicious file:

• %System%\c_130475.NLS

(Note: %System% is the Windows system folder, which is usually C:\Windows\System32.)

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• {MSC.W1758F-AA438F129C.CFF}

Other System Modifications

This backdoor adds the following registry keys:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Enum\Root\LEGACY_SRMSVR

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Enum\Root\LEGACY_SRMSVR\
0000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Enum\Root\LEGACY_SRMSVR\
0000\Control

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SRMsvr

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SRMsvr\Security

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SRMsvr\Enum

It adds the following registry entries as part of its installation routine:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Enum\Root\LEGACY_SRMSVR
NextInstance = "1"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Enum\Root\LEGACY_SRMSVR\
0000
Service = "SRMsvr"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Enum\Root\LEGACY_SRMSVR\
0000
Legacy = "1"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Enum\Root\LEGACY_SRMSVR\
0000
ConfigFlags = "0"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Enum\Root\LEGACY_SRMSVR\
0000
Class = "LegacyDriver"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Enum\Root\LEGACY_SRMSVR\
0000
ClassGUID = "{8ECC055D-047F-11D1-A537-0000F8753ED1}"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Enum\Root\LEGACY_SRMSVR\
0000
DeviceDesc = "Security Object Audit"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Enum\Root\LEGACY_SRMSVR\
0000\Control
*NewlyCreated* = "0"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Enum\Root\LEGACY_SRMSVR\
0000\Control
ActiveService = "SRMsvr"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SRMsvr
Type = "10"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SRMsvr
Start = "2"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SRMsvr
ErrorControl = "1"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SRMsvr
ImagePath = "{malware path}\{malware name}"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SRMsvr
DisplayName = "Security Object Audit"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SRMsvr
ObjectName = "LocalSystem"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SRMsvr
Description = "Responsible for performing security access checks on objects, manipulating privileges (user rights), and generating any resulting security audit messages."

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SRMsvr\Security
Security = "{values}"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SRMsvr\Enum
0 = "Root\Legacy_SRMSVR\0000"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SRMsvr\Enum
Count = "1"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SRMsvr\Enum
NextInstance = "1"

Backdoor Routine

This backdoor executes the following commands from a remote malicious user:

• Remote command prompt

It connects to the following URL(s) to send and receive commands from a remote malicious user:

• http://{BLOCKED}ll.eset-service.com:4624

It posts the following information to its command and control (C&C) server:

• Host name

However, as of this writing, the said sites are inaccessible.