BKDR_INJECT.SMW

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It runs certain commands that it receives remotely from a malicious user. Doing this puts the affected computer and information found on the computer at greater risk. It connects to a website to send and receive information.

Arrival Details

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This backdoor drops the following copies of itself into the affected system:

• %Application Data%\Microsoft\WinNT.tmp

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.)

It drops the following copies of itself into the affected system and executes them:

• %Application Data\Ado2beART.exe

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• IPKMu2tex
• IPKPMTX

It stays memory-resident by injecting codes into the following processes:

• calc.exe

Autostart Technique

This backdoor adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Ado2beART = "%Application Data%\Ado2beART.exe"

Backdoor Routine

This backdoor opens the following port(s) where it listens for remote commands:

• TCP Port 1336

It executes the following command(s) from a remote malicious user:

• Delete Auto-run registry
• Terminate itself
• Download and execute arbitrary file and save as %Application Data%\{random}.exe

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.)

It connects to the following websites to send and receive information:

• {BLOCKED}.{BLOCKED}s.com

It posts the following information to its command and control (C&C) server:

• User Name
• Computer Name
• OS Version Information

NOTES:

It creates a hidden process, which is calc.exe, where it inject its code.