BKDR_DREAMY.R

It connects to URLs to send system information and to possibly download other files.

This backdoor may be dropped by other malware. It may be unknowingly downloaded by a user while visiting malicious websites.

It opens a random port to allow a remote user to connect to the affected system. Once a successful connection is established, the remote user executes commands on the affected system.

It also has rootkit capabilities, which enables it to hide its processes and files from the user.

Arrival Details

This backdoor may be dropped by other malware.

It may be unknowingly downloaded by a user while visiting malicious websites.

Installation

This backdoor drops and executes the following files:

• %System%\[random-name].syz - rootkit component detected as TROJ_ROOTKIT.FP

(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.)

It drops the following copies of itself into the affected system:

• %System%\cssrss.exe

(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.)

Autostart Technique

This backdoor adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
WMDM PMSP Service = %System%\cssrss.exe

Other System Modifications

This backdoor creates the following registry entry(ies) to bypass Windows Firewall:

HKEY_LOCAL_MACHINE\SYSTEM\ControlControlSet\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\AuthorizedApplications\
List
{malware path and name}.exe = {malware path and name}.exe:*:Enabled:{malware name}

HKEY_LOCAL_MACHINE\SYSTEM\ControlControlSet\
Services\SharedAccess\Parameters\
FirewallPolicy\DomainProfile\AuthorizedApplications\
List
{malware path and name}.exe = {malware path and name}.exe:*:Enabled:{malware name}

Backdoor Routine

This backdoor opens a random port to allow a remote user to connect to the affected system. Once a successful connection is established, the remote user executes commands on the affected system.

Rootkit Capabilities

This backdoor also has rootkit capabilities, which enables it to hide its processes and files from the user.

Other Details

This backdoor does the following:

• It connects to the following URLs to send system information and to possibly download other files:
  
  • http://{BLOCKED}w.info/stat/stata.php?{system information}
  • http://{BLOCKED}r.info/stat/stata.php?{system information}