BKDR_MALPLU.APS

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It does not have any propagation routine.

It executes commands from a remote malicious user, effectively compromising the affected system.

Arrival Details

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This backdoor drops the following file(s)/component(s):

• %User Temp%\slc{random}.tmp - it creates this file/s for storing read html page(also will be deleted after) and also gathered information(it doesn't mean store in same file, differs in every purpose)

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.)

Propagation

This backdoor does not have any propagation routine.

Backdoor Routine

This backdoor executes the following commands from a remote malicious user:

• Capture Screenshot
• Terminate Process
• Get Drives information(Free Space,Volume Information)
• Get Operating System Information
• Get user name and computer name
• Delete arbritrary file
• Download Arbritrary File
• Execute file
• Send Gathered Information
• Modify the registry

NOTES:

When the following file exists, this backdoor deletes the file and terminates itself:

• {malware path name}\EndChk.txt

It visits the following sites:

• http://{BLOCKED}3322.{BLOCKED}g-nifty.com/blog/2013/10/love-story.html

It looks for the following string on the visited site:

• 'principal varieties are used:'

It also reads contents on the said visited site which it will use on the following created URL:

• http://{ip-address:port}/usr/{string}

Where {ip-address:port} depends on the encrypted html code. The created URL is used as C&C by where it sends and receives commands.

As of this writing, the URL generated is the following:

• http://{BLOCKED}.{BLOCKED}.34.202:51846/usr/{string}

It does not have rootkit capabilities.

It does not exploit any vulnerability.