BKDR_PTIGER.SM

This backdoor may be dropped by other malware.

It executes commands from a remote malicious user, effectively compromising the affected system.

It deletes the initially executed copy of itself.

Arrival Details

This backdoor may be dropped by the following malware:

• TROJ_MDROP.PT
• TROJ_DLOADR.BIB

Installation

This backdoor drops the following copies of itself into the affected system and executes them:

• %System%\smss32.exe

(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.)

It drops the following component file(s):

• %System%\shell64.dll - also detected as BKDR_PTIGER.SM
• %User Temp%\WinWMI.dll - contains C&C server and port information

(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.. %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003.)

Its DLL component is injected to the following process(es):

• explorer.exe

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• PittyTiger

Autostart Technique

This backdoor modifies the following registry entries to ensure it automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Winlogon
Userinit = "%System%\userinit.exe,%System%\smss32.exe,"

(Note: The default value data of the said registry entry is %System%\userinit.exe,.)

Backdoor Routine

This backdoor executes the following commands from a remote malicious user:

• Capture screen
• Connect to new C&C server
• Download file from C&C server
• Perform remote shell
• Update C&C server and port used
• Upload file to C&C server

It connects to the following URL(s) to send and receive commands from a remote malicious user:

• http://{BLOCKED}.{BLOCKED}.221.126:443/FC001/{computer name}-{random string}
• http://{BLOCKED}.{BLOCKED}.221.126:80/FC001/{computer name}-{random string}
• http://{BLOCKED}.{BLOCKED}.221.126:8080/FC001/{computer name}-{random string}
• http://{BLOCKED}u.{BLOCKED}m.com.tw:443/FC001/{computer name}-{random string}
• http://{BLOCKED}u.{BLOCKED}m.com.tw:80/FC001/{computer name}-{random string}
• http://{BLOCKED}u.{BLOCKED}m.com.tw:8080/FC001/{computer name}-{random string}
• http://{BLOCKED}g.{BLOCKED}m.com.tw:443/FC001/{computer name}-{random string}
• http://{BLOCKED}g.{BLOCKED}m.com.tw:80/FC001/{computer name}-{random string}
• http://{BLOCKED}g.{BLOCKED}m.com.tw:8080/FC001/{computer name}-{random string}

Other Details

This backdoor deletes the initially executed copy of itself