BKDR_QAKBOT.EA
Windows 2000, XP, Server 2003
Threat Type: Backdoor
Destructiveness: No
Encrypted: No
In the wild: Yes
OVERVIEW
This backdoor may arrive bundled with malware packages as a malware component. It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.
It reads its configuration file that contains commands and data to be sent to a remote server.
TECHNICAL DETAILS
81,920 bytes
PE
Yes
28 Oct 2010
Downloads files, Terminates processes, Compromises system security
Arrival Details
This backdoor may arrive bundled with malware packages as a malware component.
It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.
Installation
This backdoor is injected into the following processes running in memory:
- EXPLORER.EXE
- IEXPLORER.EXE
Backdoor Routine
This backdoor reads its configuration file that contains commands and data to be sent to a remote server.
It connects to the following URL(s) to send and receive commands from a remote malicious user:
- {BLOCKED}cdc2121cdsfdfd.com
- {BLOCKED}v.co.in
- {BLOCKED}4.cn
- {BLOCKED}1.co.in
- {BLOCKED}2.co.in
- {BLOCKED}3.in
- {BLOCKED}3.com.ua
Process Termination
This backdoor terminates the following processes if found running in the affected system's memory:
- agnitum
- ahnlab
- arcabit
- avast
- avg
- avira
- avp
- bitdefender
- bit9
- castlecops
- centralcommand
- clamav
- comodo
- computerassociates
- cpsecure
- defender
- drweb
- emsisoft
- esafe
- eset
- etrust
- ewido
- fortinet
- f-prot
- f-secure
- gdata
- grisoft
- hacksoft
- hauri
- ikarus
- jotti
- k7computing
- kaspersky
- malware
- mcafee
- microsoft
- networkassociates
- nod32
- norman
- norton
- panda
- pctools
- prevx
- quickheal
- rising
- rootkit
- securecomputing
- sophos
- spamhaus
- spyware
- sunbelt
- symantec
- threatexpert
- trendmicro
- virus
- wilderssecurity
- windowsupdate
- msdev.exe
- dbgview.exe
- mirc.exe
- ollydbg.exe
- ccApp.exe
- skype
- R&Q.exe
- photoed
- outlook.exe
- mmc.exe
- ctfmon.exe
Download Routine
This backdoor connects to the following website(s) to download and execute a malicious file:
- http://{BLOCKED}2.cn/cgi-bin/jl/jloader.pl
- http://{BLOCKED}6.in/cgi-bin/jl/jloader.pl
- http://{BLOCKED}ver.com.ua/cgi-bin/exhandler4.pl
- http://{BLOCKED}ver.com.ua/cgi-bin/ss.pl
- http://{BLOCKED}wthewhistle.com/cgi-bin/clientinfo3.pl
It connects to the following URL(s) to download its configuration file:
- http://{BLOCKED}2.cn/
- http://{BLOCKED}6.in/
- http://{BLOCKED}ver.com
- http://{BLOCKED}ver.com
- http://{BLOCKED}wthewhistle.com
- http://www.{BLOCKED}cdc2121cdsfdfd.com
SOLUTION
8.900
Step 1
Scan your computer with your Trend Micro product and note files detected as BKDR_QAKBOT.EA
Step 2
Restart in Safe Mode
Step 3
Search and delete the file detected as BKDR_QAKBOT.EA
Step 4
Scan your computer with your Trend Micro product to delete files detected as BKDR_QAKBOT.EA. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check this Knowledge Base page for more information.
Did this description help? Tell us how we did.