BKDR_POISON.ETQP

This backdoor arrives as an attachment to email messages spammed by other malware/grayware or malicious users.

It connects to a website to send and receive information.

Arrival Details

This backdoor arrives as an attachment to email messages spammed by other malware/grayware or malicious users.

Installation

This backdoor adds the following folders:

• %System Root%\dfed

(Note: %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.)

It drops the following files:

• %System Root%\asf - empty file

(Note: %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.)

It drops the following copies of itself into the affected system:

• %System%:applesups.exe

(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.)

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• AK#%JS!DA
• #F*AJJ^@F

It injects itself into the following processes as part of its memory residency routine:

• explorer.exe

Autostart Technique

This backdoor adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Active Setup\Installed Components\{351D4F5A-7954-7732-8265-6818E9DD2A7B}
StubPath = "%System%:applesups.exe"

Backdoor Routine

This backdoor connects to the following websites to send and receive information:

• {BLOCKED}e-com.3322.org
• {BLOCKED}.dyndns-free.com

NOTES:

It queries the default web browser by accessing the following registry entry:

HKEY_CLASSES_ROOT\http\shell\open\command

It then launches a hidden Web browser process (e.g. iexplore.exe) where this malware injects its code for its backdoor routines.

This backdoor has the following capabilities:

• Capture screen shots, webcam, audio
• Delete, search, and upload files
• Download and inject remote codes to legitimate processes
• Log keystrokes and active window
• Manage processes and services
• Modify and search the registry entries
• Perform a shell command
• Send system information (IP address, computer name, user name, operating system)
• Update/Uninstall the malware
• View and terminate active windows and ports