BKDR_DARKMOON.K

The malware determines the default Internet browser of the affected system by querying a certain registry entry.

It then injects a thread in the browser if an instance of it is running. If the browser is not found to be running, the malware opens a new process of the said browser where it injects its thread that connects to the remote server. This enables the remote user to execute arbitrary commands on the affected system.

This backdoor arrives as an attachment to email messages spammed by other malware/grayware or malicious users.

It does not have any propagation routine.

It does not have any downloading capability.

It does not have any information-stealing capability.

Arrival Details

This backdoor arrives as an attachment to email messages spammed by other malware/grayware or malicious users.

Installation

This backdoor adds the following mutexes to ensure that only one of its copies runs at any one time:

• DK*&#KAUY

It injects threads into the following normal process(es):

• Explorer.exe

Other System Modifications

This backdoor adds the following registry keys:

HKEY_CURRENT_USER\Software\Local AppWizard-GeneraTed Applications\
bricks

HKEY_CURRENT_USER\Software\Local AppWizard-GeneraTed Applications\
bricks\Recent File List

HKEY_CURRENT_USER\Software\Local AppWizard-GeneraTed Applications\
bricks\Settings

Propagation

This backdoor does not have any propagation routine.

Backdoor Routine

This backdoor connects to the following URL(s) to send and receive commands from a remote malicious user:

• {BLOCKED}n.dyndns-mail.com

Download Routine

This backdoor does not have any downloading capability.

Information Theft

This backdoor does not have any information-stealing capability.

NOTES:

Other Details
The malware determines the default Internet browser of the affected system by querying the following registry entry:

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\http\shell\open\command
(default) = "{path and filename of Internet Browser}"

It does not have rootkit capabilities.

It does not exploit any vulnerability.