BKDR_WKYSOL.SM

This backdoor may be dropped by other malware.

It does not have any propagation routine.

It executes commands from a remote malicious user, effectively compromising the affected system. It connects to a website to send and receive information.

It takes advantage of certain vulnerabilities.

Arrival Details

This backdoor may be dropped by the following malware:

• TROJ_ARTIEF.CR

Installation

This backdoor drops the following component file(s):

• %User Profile%\Local Settings\{malware file name 1}.dll - also detected as BKDR_WKYSOL.SM
• %User Profile%\Local Settings\setm.ini
• %User Temp%\tpdefense.dat

(Note: %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003, or C:\Users\{user name} on Windows Vista and 7.. %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.)

It is injected into the following processes running in memory:

• IEXPLORE.EXE

Autostart Technique

This backdoor adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
start = "{folder where malware is located}\{malware file name 2}.exe -installkys"

Propagation

This backdoor does not have any propagation routine.

Backdoor Routine

This backdoor executes the following commands from a remote malicious user:

• Download and Upload arbitrary files
• Command Shell
• Create/Terminate Process
• Create,Open and Delete files
• Reboot the computer

It connects to the following websites to send and receive information:

• http://www.{BLOCKED}cus.com

As of this writing, the said sites are inaccessible.

Other Details

This backdoor takes advantage of the following vulnerabilities:

• CVE-2012-0002

NOTES:

This backdoor gets its settings from the configuration file %User Profile%\Local Settings\setm.ini. This configuration file contains the following:

• Sleep time of the malware
• The URL it connects to
• File names of the component files
• Bot ID

It connects to the following remote site to download a possible configuration or component file that contains its intended routines and send back information such as host name and IP address:

• http://{malicious site}/kys_allow_get.asp?name=getkys.jpg&hostname={hostname}-{IP Address}

This backdoor is also capable of deleting the registry entries it adds when the parameter -removekys is passed on to it by its component file.

It does not have rootkit capabilities.

Note that {malware file name 1} can be any of the following:

• date.dll
• update.dll

And {malware file name 2} can be any of the following:

• EBWin.exe
• update.exe