BKDR_PRESHIN.JTT

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. It may be downloaded from remote sites by other malware.

It executes commands from a remote malicious user, effectively compromising the affected system.

It steals certain information from the system and/or the user.

Arrival Details

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It may be downloaded from remote site(s) by the following malware:

• TROJ_PRESHIN.JTT

Installation

This backdoor drops the following file(s)/component(s):

• %User Profile%\set.ini - encrypted component
• %User Profile%\rundll32.exe
• %User Profile%\dbgeng.dll
• %User Temp%\{random}ptd.bat - deleted after execution. This contains commands to list system information

(Note: %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003, or C:\Users\{user name} on Windows Vista and 7.. %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.)

It adds the following processes:

• iexplore.exe

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• Ultro_ISO_0369

Autostart Technique

This backdoor adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
dllhost services = "%User Profile%\rundll32.exe"

Backdoor Routine

This backdoor executes the following commands from a remote malicious user:

• Download and execute arbitrary file
• Download file

It connects to the following URL(s) to send and receive commands from a remote malicious user:

• http://{BLOCKED}.{BLOCKED}.3.122:8080/logon.php?{random value}

Download Routine

This backdoor saves the files it downloads using the following names:

• %User Temp%\{random}up.dat

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.)

Information Theft

This backdoor steals the following information:

• IP configuration
• List of running services
• Network connections
• List of computers in current domain

Stolen Information

This backdoor saves the stolen information in the following file:

• %User Temp%\wg{number}.dat - deleted afterwards

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.)

NOTES:
It steals passwords stored related to the following:

• MS Outlook
• Internet Explorer