BKDR_QUEJOB.EVL

This backdoor is noteworthy as it poses as an installer of Facebook messenger.

To get a one-glance comprehensive view of the behavior of this Backdoor, refer to the Threat Diagram shown below.

This backdoor arrives as an attachment to email messages spammed by other malware/grayware or malicious users.

Arrival Details

This backdoor arrives as an attachment to email messages spammed by other malware/grayware or malicious users.

Installation

This backdoor drops the following non-malicious file:

• %Application Data%\common.data

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Windows\Profiles\{user name}\Application Data on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Application Data on Windows NT, and C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, XP, and Server 2003.)

Autostart Technique

This backdoor adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
AutoStart = "{malware path and file name}.exe"

NOTES:

Backdoor Routine

This backdoor opens the following port(s) where it listens for remote commands:

• TCP Port 1098

It executes the following commands from a remote malicious user:

• Update itself
• Download and execute files
• Start a process

It connects to the following URL(s) to send and receive commands from a remote malicious user:

• {BLOCKED}.{BLOCKED}.216.50

Other Details

This backdoor queries if antivirus products are installed on the infected system. The result is then sent to the following SMTP server via email:

• smtp.{BLOCKED}il.ru

It also checks the OS version used by the infected system. It then sends the gathered information to the remote server.

This backdoor poses as an installer of Facebook messenger.