BKDR_FARFLI.ABH

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This backdoor drops the following files:

• %System Root%\Game.exe
• %System Root%\Common\Utility.dll
• %Program Files%\Jpxv\Hhafqonho.jpg

(Note: %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.. %Program Files% is the default Program Files folder, usually C:\Program Files.)

It creates the following folders:

• %System Root%\Common
• %Program Files%\Jpxv

(Note: %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.. %Program Files% is the default Program Files folder, usually C:\Program Files.)

Other System Modifications

This backdoor adds the following registry entries as part of its installation routine:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\SvcHost
sougou = Otklkp Pqumryac Jlb

HKEY_LOCAL_MACHINE\SOFTWARE\281052745
ImagePath = "%System%\svchost.exe -k sougou"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Enum\Root\LEGACY_OTKLKP_PQUMRYAC_JLB\
0000
Service = "Otklkp Pqumryac Jlb"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\SvcHost
sougou = "Otklkp Pqumryac Jlb"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\Otklkp Pqumryac Jlb
ImagePath = "%System%\svchost.exe -k sougou"

It adds the following registry keys as part of its installation routine:

HKEY_LOCAL_MACHINE\SOFTWARE\281052745

HKEY_LOCAL_MACHINE\SOFTWARE\323830095

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Enum\Root\LEGACY_OTKLKP_PQUMRYAC_JLB

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\Otklkp Pqumryac Jlb

Other Details

This backdoor connects to the following possibly malicious URL:

• {BLOCKED}22.org