BKDR_SIMDA.PD

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

However, as of this writing, the said sites are inaccessible.

Arrival Details

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This backdoor drops the following files:

• %Application Data%\Mozilla\Firefox\Profiles\{user profile}\searchplugins\search.xml
• %Application Data%\{random name}.reg
• %Application Data%\mcp.ico
• %Desktop%\Computer.lnk
• %User Temp%\{random name}.sys - encrypted

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.. %Desktop% is the current user's desktop, which is usually C:\Documents and Settings\{User Name}\Desktop on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\Desktop on Windows Vista and 7.. %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.)

It drops the following copies of itself into the affected system:

• %Application Data%\ScanDisc.exe
• %Application Data%\{random name}.exe
• %User Temp%\{random number}.tmp

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.. %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.)

Autostart Technique

This backdoor adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\RunOnce
{random name} = "%Application Data%\{random name}.exe"

Other System Modifications

This backdoor adds the following registry entries:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Policies\
System
ConsentPromptBehaviorAdmin = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Policies\
System
ConsentPromptBehaviorUser = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Policies\
System
EnableLUA = "0"

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows
update = "shortcut"

Backdoor Routine

This backdoor connects to the following URL(s) to send and receive commands from a remote malicious user:

• http://update.{pseudorandom string}.com
• http://report.{pseudorandom string}.com/?{random string}={random value}
• http://{BLOCKED}.{BLOCKED}.0.120/?{random string}={random value}
• http://{BLOCKED}.{BLOCKED}.116.81/?{random string}={random value}
• http://{BLOCKED}.{BLOCKED}.0.122/?{random string}={random value}

However, as of this writing, the said sites are inaccessible.

Download Routine

This backdoor downloads an updated copy of itself from the following website(s):

• http://{BLOCKED}1.randomstring.com/?abbr=RTK&setupType=update&uid={random number}&ttl={random string}&controller=microinstaller&pid=3
• http://{BLOCKED}1.randomstring.com/update_c1eec.exe
• http://{BLOCKED}1.{BLOCKED}main.com/?abbr=RTK&action=download&setupType=umx&setupFileName=process_64.exe
• http://{BLOCKED}1.randomstring.com/?controller=hash

It saves the files it downloads using the following names:

• %User Temp%\{random number}.exe
• %System Root%\text.exe

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.. %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.)

HOSTS File Modification

This backdoor modifies the system's HOSTS files to redirect users once the following Web site(s) are accessed:

• www.google-analytics.com
• ad-emea.doubleclick.net
• www.statcounter.com

Information Theft

This backdoor gathers the following data:

• Volume Information
• Language Information
• Computer Name
• Network Adapter
• SusClientId
• Product Id
• Windows Install Date

Other Details

This backdoor checks for the presence of the following process(es):

• cv.exe
• irise.exe
• IrisSvc.exe
• wireshark.exe
• dumpcap.exe
• ZxSniffer.exe
• Aircrack-ng Gui.exe
• observer.exe
• tcpdump.exe
• WinDump.exe
• wspass.exe
• Regshot.exe
• ollydbg.exe
• PEBrowseDbg.exe
• windbg.exe
• DrvLoader.exe
• SymRecv.exe
• Syser.exe
• apis32.exe
• VBoxService.exe
• VBoxTray.exe
• SbieSvc.exe
• SbieCtrl.exe
• SandboxieRpcSs.exe
• SandboxieDcomLaunch.exe
• SUPERAntiSpyware.exe
• ERUNT.exe
• ERDNT.exe
• EtherD.exe
• Sniffer.exe
• CamtasiaStudio.exe
• CamRecorder.exe

NOTES:

This backdoor attempts to open the file %System Root%\cgvi5r6i\vgdgfd.72g, which may contain shell commands. It executes the following commands from a remote malicious user:

• Update itself
• Monitor browser activity
• Download and execute arbitrary files

It redirects the following sites when accessed:

• ar.search.yahoo.com - {BLOCKED}.{BLOCKED}.112.8
• at.bing.com - {BLOCKED}.{BLOCKED}.68.97
• at.search.yahoo.com - {BLOCKED}.{BLOCKED}.112.8
• au.bing.com - {BLOCKED}.{BLOCKED}.68.97
• au.search.yahoo.com - {BLOCKED}.{BLOCKED}.112.8
• bing.com - {BLOCKED}.{BLOCKED}.68.97
• br.bing.com - {BLOCKED}.{BLOCKED}.68.97
• br.search.yahoo.com - {BLOCKED}.{BLOCKED}.112.8
• ca.bing.com - {BLOCKED}.{BLOCKED}.68.97
• ca.search.yahoo.com - {BLOCKED}.{BLOCKED}.112.8
• ch.bing.com - {BLOCKED}.{BLOCKED}.68.97
• ch.search.yahoo.com - {BLOCKED}.{BLOCKED}.112.8
• cl.search.yahoo.com - {BLOCKED}.{BLOCKED}.112.8
• cn.search.yahoo.com - {BLOCKED}.{BLOCKED}.112.8
• co.search.yahoo.com - {BLOCKED}.{BLOCKED}.112.8
• connect.facebook.net - {BLOCKED}.{BLOCKED}.87.101
• cz.bing.com - {BLOCKED}.{BLOCKED}.68.97
• cz.search.yahoo.com - {BLOCKED}.{BLOCKED}.112.8
• de.bing.com - {BLOCKED}.{BLOCKED}.68.97
• de.search.yahoo.com - {BLOCKED}.{BLOCKED}.112.8
• dk.bing.com - {BLOCKED}.{BLOCKED}.68.97
• dk.search.yahoo.com - {BLOCKED}.{BLOCKED}.112.8
• es.bing.com - {BLOCKED}.{BLOCKED}.68.97
• es.search.yahoo.com - {BLOCKED}.{BLOCKED}.112.8
• fi.bing.com - {BLOCKED}.{BLOCKED}.68.97
• fi.search.yahoo.com - {BLOCKED}.{BLOCKED}.112.8
• fr.bing.com - {BLOCKED}.{BLOCKED}.68.97
• fr.search.yahoo.com - {BLOCKED}.{BLOCKED}.112.8
• gb.bing.com - {BLOCKED}.{BLOCKED}.68.97
• google-analytics.com - {BLOCKED}.{BLOCKED}.87.101
• google.ae - {BLOCKED}.{BLOCKED}.87.147
• google.at - {BLOCKED}.{BLOCKED}.87.103
• google.ba - {BLOCKED}.{BLOCKED}.87.147
• google.be - {BLOCKED}.{BLOCKED}.87.148
• google.bg - {BLOCKED}.{BLOCKED}.87.147
• google.ca - {BLOCKED}.{BLOCKED}.87.152
• google.ch - {BLOCKED}.{BLOCKED}.87.155
• google.cl - {BLOCKED}.{BLOCKED}.87.147
• google.co.com - {BLOCKED}.{BLOCKED}.87.147
• google.co.id - {BLOCKED}.{BLOCKED}.87.147
• google.co.il - {BLOCKED}.{BLOCKED}.87.147
• google.co.in - {BLOCKED}.{BLOCKED}.87.103
• google.co.jp - {BLOCKED}.{BLOCKED}.87.103
• google.co.nz - {BLOCKED}.{BLOCKED}.87.103
• google.co.th - {BLOCKED}.{BLOCKED}.87.147
• google.co.uk - {BLOCKED}.{BLOCKED}.87.103
• google.co.ve - {BLOCKED}.{BLOCKED}.87.147
• google.co.za - {BLOCKED}.{BLOCKED}.87.103
• google.com - {BLOCKED}.{BLOCKED}.87.103
• google.com.ar - {BLOCKED}.{BLOCKED}.87.103
• google.com.au - {BLOCKED}.{BLOCKED}.87.104
• google.com.br - {BLOCKED}.{BLOCKED}.87.109
• google.com.co - {BLOCKED}.{BLOCKED}.87.147
• google.com.ec - {BLOCKED}.{BLOCKED}.87.147
• google.com.mx - {BLOCKED}.{BLOCKED}.87.147
• google.com.my - {BLOCKED}.{BLOCKED}.87.147
• google.com.pe - {BLOCKED}.{BLOCKED}.87.147
• google.com.ph - {BLOCKED}.{BLOCKED}.87.147
• google.com.pr - {BLOCKED}.{BLOCKED}.87.147
• google.com.sa - {BLOCKED}.{BLOCKED}.87.147
• google.com.sg - {BLOCKED}.{BLOCKED}.87.147
• google.com.tr - {BLOCKED}.{BLOCKED}.87.103
• google.com.vn - {BLOCKED}.{BLOCKED}.87.147
• google.com.za - {BLOCKED}.{BLOCKED}.87.147
• google.cz - {BLOCKED}.{BLOCKED}.87.103
• google.de - {BLOCKED}.{BLOCKED}.87.160
• google.dk - {BLOCKED}.{BLOCKED}.87.123
• google.ee - {BLOCKED}.{BLOCKED}.87.147
• google.es - {BLOCKED}.{BLOCKED}.87.103
• google.fi - {BLOCKED}.{BLOCKED}.87.103
• google.fr - {BLOCKED}.{BLOCKED}.87.154
• google.gr - {BLOCKED}.{BLOCKED}.87.103
• google.hr - {BLOCKED}.{BLOCKED}.87.147
• google.hu - {BLOCKED}.{BLOCKED}.87.103
• google.ie - {BLOCKED}.{BLOCKED}.87.170
• google.it - {BLOCKED}.{BLOCKED}.87.173
• google.lt - {BLOCKED}.{BLOCKED}.87.147
• google.nl - {BLOCKED}.{BLOCKED}.87.103
• google.no - {BLOCKED}.{BLOCKED}.87.103
• google.pl - {BLOCKED}.{BLOCKED}.87.103
• google.pt - {BLOCKED}.{BLOCKED}.87.103
• google.ro - {BLOCKED}.{BLOCKED}.87.103
• google.rs - {BLOCKED}.{BLOCKED}.87.147
• google.se - {BLOCKED}.{BLOCKED}.87.103
• google.si - {BLOCKED}.{BLOCKED}.87.147
• google.sk - {BLOCKED}.{BLOCKED}.87.147
• google.sn - {BLOCKED}.{BLOCKED}.87.147
• gr.bing.com - {BLOCKED}.{BLOCKED}.68.97
• gr.search.yahoo.com - {BLOCKED}.{BLOCKED}.112.8
• gr.uk.search.yahoo.com - {BLOCKED}.{BLOCKED}.112.8
• hu.bing.com - {BLOCKED}.{BLOCKED}.68.97
• hu.search.yahoo.com - {BLOCKED}.{BLOCKED}.112.8
• id.search.yahoo.com - {BLOCKED}.{BLOCKED}.112.8
• ie.bing.com - {BLOCKED}.{BLOCKED}.68.97
• ie.search.yahoo.com - {BLOCKED}.{BLOCKED}.112.8
• in.search.yahoo.com - {BLOCKED}.{BLOCKED}.112.8
• ir.bing.com - {BLOCKED}.{BLOCKED}.68.97
• ir.uk.search.yahoo.com - {BLOCKED}.{BLOCKED}.239.84
• it.bing.com - {BLOCKED}.{BLOCKED}.68.97
• it.search.yahoo.com - {BLOCKED}.{BLOCKED}.112.8
• malaysia.search.yahoo.com - {BLOCKED}.{BLOCKED}.112.8
• mx.search.yahoo.com - {BLOCKED}.{BLOCKED}.112.8
• nl.bing.com - {BLOCKED}.{BLOCKED}.68.97
• nl.search.yahoo.com - {BLOCKED}.{BLOCKED}.112.8
• no.bing.com - {BLOCKED}.{BLOCKED}.68.97
• no.search.yahoo.com - {BLOCKED}.{BLOCKED}.112.8
• nz.search.yahoo.com - {BLOCKED}.{BLOCKED}.112.8
• ph.search.yahoo.com - {BLOCKED}.{BLOCKED}.112.8
• pl.bing.com - {BLOCKED}.{BLOCKED}.68.97
• pl.search.yahoo.com - {BLOCKED}.{BLOCKED}.112.8
• platform.twitter.com - {BLOCKED}.{BLOCKED}.87.101
• platform.twitter.com - {BLOCKED}.{BLOCKED}.87.101
• pt.bing.com - {BLOCKED}.{BLOCKED}.68.97
• pt.search.yahoo.com - {BLOCKED}.{BLOCKED}.112.8
• ro.bing.com - {BLOCKED}.{BLOCKED}.68.97
• ro.search.yahoo.com - {BLOCKED}.{BLOCKED}.112.8
• se.bing.com - {BLOCKED}.{BLOCKED}.68.97
• se.search.yahoo.com - {BLOCKED}.{BLOCKED}.112.8
• search.yahoo.co.jp - {BLOCKED}.{BLOCKED}.112.8
• search.yahoo.com - {BLOCKED}.[BLOCKED}.186.249
• sg.search.yahoo.com - {BLOCKED}.{BLOCKED}.112.8
• th.search.yahoo.com - {BLOCKED}.{BLOCKED}.112.8
• tr.bing.com - {BLOCKED}.{BLOCKED}.68.97
• tr.search.yahoo.com - {BLOCKED}.{BLOCKED}.112.8
• uk.search.yahoo.com - {BLOCKED}.{BLOCKED}.112.8
• ve.search.yahoo.com - {BLOCKED}.{BLOCKED}.112.8
• vn.search.yahoo.com - {BLOCKED}.{BLOCKED}.112.8
• www.bing.com - {BLOCKED}.{BLOCKED}.68.97
• www.google-analytics.com - {BLOCKED}.{BLOCKED}.87.101
• www.google.ae - {BLOCKED}.{BLOCKED}.87.147
• www.google.at - {BLOCKED}.{BLOCKED}.87.147
• www.google.ba - {BLOCKED}.{BLOCKED}.87.147
• www.google.be - {BLOCKED}.{BLOCKED}.87.149
• www.google.bg - {BLOCKED}.{BLOCKED}.87.147
• www.google.ca - {BLOCKED}.{BLOCKED}.87.153
• www.google.ch - {BLOCKED}.{BLOCKED}.87.158
• www.google.cl - {BLOCKED}.{BLOCKED}.87.147
• www.google.co.com - {BLOCKED}.{BLOCKED}.87.147
• www.google.co.id - {BLOCKED}.{BLOCKED}.87.147
• www.google.co.il - {BLOCKED}.{BLOCKED}.87.147
• www.google.co.in - {BLOCKED}.{BLOCKED}.87.147
• www.google.co.jp - {BLOCKED}.{BLOCKED}.87.147
• www.google.co.nz - {BLOCKED}.{BLOCKED}.87.147
• www.google.co.th - {BLOCKED}.{BLOCKED}.87.147
• www.google.co.uk - {BLOCKED}.{BLOCKED}.87.147
• www.google.co.ve - {BLOCKED}.{BLOCKED}.87.147
• www.google.co.za - {BLOCKED}.{BLOCKED}.87.147
• www.google.com.ar - {BLOCKED}.{BLOCKED}.87.147
• www.google.com.au - {BLOCKED}.{BLOCKED}.87.147
• www.google.com.br - {BLOCKED}.{BLOCKED}.87.150
• www.google.com.co - {BLOCKED}.{BLOCKED}.87.147
• www.google.com.ec - {BLOCKED}.{BLOCKED}.87.147
• www.google.com.mx - {BLOCKED}.{BLOCKED}.87.147
• www.google.com.my - {BLOCKED}.{BLOCKED}.87.147
• www.google.com.pe - {BLOCKED}.{BLOCKED}.87.147
• www.google.com.ph - {BLOCKED}.{BLOCKED}.87.147
• www.google.com.pr - {BLOCKED}.{BLOCKED}.87.147
• www.google.com.sa - {BLOCKED}.{BLOCKED}.87.147
• www.google.com.sg - {BLOCKED}.{BLOCKED}.87.147
• www.google.com.tr - {BLOCKED}.{BLOCKED}.87.147
• www.google.com.vn - {BLOCKED}.{BLOCKED}.87.147
• www.google.com.za - {BLOCKED}.{BLOCKED}.87.147
• www.google.cz - {BLOCKED}.{BLOCKED}.87.147
• www.google.de - {BLOCKED}.{BLOCKED}.87.161
• www.google.dk - {BLOCKED}.{BLOCKED}.87.160
• www.google.ee - {BLOCKED}.{BLOCKED}.87.147
• www.google.es - {BLOCKED}.{BLOCKED}.87.147
• www.google.fi - {BLOCKED}.{BLOCKED}.87.147
• www.google.fr - {BLOCKED}.{BLOCKED}.87.134
• www.google.gr - {BLOCKED}.{BLOCKED}.87.147
• www.google.hr - {BLOCKED}.{BLOCKED}.87.147
• www.google.hu - {BLOCKED}.{BLOCKED}.87.147
• www.google.ie - {BLOCKED}.{BLOCKED}.87.177
• www.google.it - {BLOCKED}.{BLOCKED}.87.147
• www.google.lt - {BLOCKED}.{BLOCKED}.87.147
• www.google.nl - {BLOCKED}.{BLOCKED}.87.147
• www.google.no - {BLOCKED}.{BLOCKED}.87.147
• www.google.pl - {BLOCKED}.{BLOCKED}.87.147
• www.google.pt - {BLOCKED}.{BLOCKED}.87.147
• www.google.ro - {BLOCKED}.{BLOCKED}.87.147
• www.google.rs - {BLOCKED}.{BLOCKED}.87.147
• www.google.se - {BLOCKED}.{BLOCKED}.87.147
• www.google.si - {BLOCKED}.{BLOCKED}.87.147
• www.google.sk - {BLOCKED}.{BLOCKED}.87.147
• www.google.sn - {BLOCKED}.{BLOCKED}.87.147
• www.search.yahoo.com - {BLOCKED}.{BLOCKED}.186.249
• za.search.yahoo.com - {BLOCKED}.{BLOCKED}.112.8

It checks for the existence of the following software under certain registry keys :

• In HKEY_CURRENT_USER\Software:
• APIS32
• B Labs\Bopup Observer
• CommView
• Cygwin
• eEye Digital Security
• SUPERAntiSpyware.com
• Syser Soft
• Win Sniffer
• ZxSniffer
• In HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall:
• APIS32
• ERUNT_is1
• Oracle VM VirtualBox Guest Additions
• Sandboxie
• Win Sniffer_is1
• Wireshark
• In HKEY_CURRENT_USER\SYSTEM\CurrentControlSet\Services:
• IRIS5
• SDbgMsg
• VBoxGuest
• SbieDrv
• In HKEY_CURRENT_USER\SOFTWARE\Classes:
• SUPERAntiSpywareContextMenuExt.SASCon.1
• PEBrowseDotNETProfiler.DotNETProfiler
• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu2\Programs:
• Debugging Tools for Windows (x86)
• APIS32
• HKEY_CURRENT_USER\Software\Classes\Folder\shell\sandbox
• HKEY_CURRENT_USER\Software\Classes\*\shell\sandbox
• HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\wireshark.exe
• HKEY_CURRENT_USER\AppEvents\Schemes\Apps\Bopup Observer

It also checks for loaded libraries:

• SBIEDLL.DLL
• SBIEDLLX.DLL
• DBGHELP.DLL

It also checks if the following information are equal:

• Computer Name = Sandbox
• User name = CurrentUser
• File name = file.exe

When a number of conditions are met, this backdoor executes in an infinite loop.

It appends the legitimate file %User Profile%\Application Data\Mozilla\Firefox\Profiles\{random}\prefs.js with user_pref(browser.search.selectedEngine http://{BLOCKED}la.com/?uid={number}&q={searchTerms}).