BKDR_RSLAVE.A

This backdoor connects to a certain URL to send and receive commands from a remote malicious user. It is capable of executing the certain backdoor commands. It also performs a HTTP POST request. However, as of this writing, the server does not respond to the request.

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. It may be downloaded by other malware/grayware/spyware from remote sites.

It does not have any propagation routine.

Arrival Details

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It may be downloaded by other malware/grayware/spyware from remote sites.

Other System Modifications

This backdoor adds the following registry entries:

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Main
IE8RunLastRead = "4e3152a2"

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Main
IE8RunLastDraft = "4e3152a2"

Propagation

This backdoor does not have any propagation routine.

Backdoor Routine

This backdoor connects to the following URL(s) to send and receive commands from a remote malicious user:

• {BLOCKED}u.xxuz.com

NOTES:

It is capable of executing the following backdoor commands:

• Download and execute other possibly malicious file(s) from the Internet
• Restart itself
• Steal information related to Gmail (user name, password, etc.)
• Terminate itself

It sends the following information to its C&C server:

• Computer name
• IP address
• User name
• Windows version
• Information related to Gmail (user name, password, etc.)

It also performs the following HTTP POST request:

• http://{BLOCKED}u.xxuz.com/ym/Attachments?YY={parameters}

As of this writing, the server does not respond to the request.

It does not have rootkit capabilities.

It does not exploit any vulnerability.