ENFAL


 ALIASES:

Samsa, Samkams

 PLATFORM:

Windows 2000, Windows Server 2003, Windows XP (32-bit, 64-bit), Windows Vista (32-bit, 64-bit), Windows 7 (32-bit, 64-bit)

 OVERALL RISK RATING:
 DAMAGE POTENTIAL:
 DISTRIBUTION POTENTIAL:
 REPORTED INFECTION:

  • Threat Type: Backdoor

  • Destructiveness: No

  • Encrypted:

  • In the wild: Yes

  OVERVIEW

Infection Channel:

Downloaded from the Internet


ENFAL is a backdoor that is specifically used for downloading other malware. It is used in several targeted attacks.

ENFAL gathers system information such as the infected computer's MAC and IP addresses and operating system version. It then sends all gathered information to its command-and-control servers.

  TECHNICAL DETAILS

Memory Resident:

Yes

Payload:

Connects to URLs/IPs

Installation

This backdoor drops the following copies of itself into the affected system:

  • %System%\AntNet.exe
  • %System%\DBGRID32.exe
  • %System%\DisMgnt.exe
  • %System%\NetInt.exe
  • %System%\Winkrnl.exe
  • %System%\dllcnfg.exe
  • %System%\dmgrd.exe
  • %System%\encapi.exe
  • %System%\win32.exe
  • %System%\winlog.exe

(Note: %System% is the Windows system folder, which is usually C:\Windows\System32.)

Autostart Technique

This backdoor modifies the following registry entries to ensure it automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Winlogon
Userinit = "%System%\userinit.exe,%System%\winlog.exe"

(Note: The default value data of the said registry entry is "%System%\userinit.exe,".)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Winlogon
Userinit = "%System%\userinit.exe,%System%\dllcnfg.exe"

(Note: The default value data of the said registry entry is "%System%\userinit.exe,".)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Winlogon
Userinit = "%System%\userinit.exe,%System%\NetInt.exe"

(Note: The default value data of the said registry entry is "%System%\userinit.exe,".)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Winlogon
Userinit = "%System%\userinit.exe,%System%\encapi.exe"

(Note: The default value data of the said registry entry is "%System%\userinit.exe,".)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Winlogon
Userinit = "%System%\userinit.exe,%System%\DisMgnt.exe"

(Note: The default value data of the said registry entry is "%System%\userinit.exe,".)

Other Details

This backdoor connects to the following possibly malicious URL:

  • news.{BLOCKED}xp.com
  • www.{BLOCKED}s.com
  • www.{BLOCKED}indian.com
  • www.{BLOCKED}ers.com
  • yz2.{BLOCKED}nnt.com