Backdoor.Win32.FARFLI.MRD

This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes then deletes itself afterward.

It does not have any propagation routine.

Arrival Details

This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Backdoor drops the following copies of itself into the affected system:

• %Windows%\arphaCrashReport.exe
• %System%\Tlctl.exe

(Note: %Windows% is the Windows folder, where it usually is C:\Windows on all Windows operating system versions.. %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.)

It drops the following files:

• %System%\drivers\QAssist.sys -> Hide itself after execution

(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.)

It adds the following processes:

• %System%\cmd.exe /c ping -n 2 127.0.0.1 > nul && del %User Temp%\87322C~1.EXE > nul
• %System%\Tlctl.exe -auto
• %System%\Tlctl.exe -acsi
• %System%\PING.EXE ping -n 2 127.0.0.1

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It executes then deletes itself afterward.

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• Global\{random}=
• Global\%System%\Tlctl.exe -acsi
• Global\%System%\Tlctl.exe -auto

(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.)

Autostart Technique

This Backdoor adds and runs the following services:

• • Service Name: 瑞昱声卡相关辅助程序
  • DisplayName = 瑞昱声卡相关辅助程序
  • ImagePath =: %System%\Tlctl.exe -auto
  • Description =: 瑞昱声卡相关辅助程序
• • Service Name: QAssist
  • DisplayName = QAssist
  • ImagePath = system32\DRIVERS\QAssist.sys
  • Hid_IgnoredImages= %System%\Services.exe

(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.)

Other System Modifications

This Backdoor adds the following registry entries as part of its installation routine:

HKEY_LOCAL_MACHINE\SYSTEM\Select
MarkTime = {Date Execution of the sample

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
services\QAssist
Start = 1

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
services\QAssist
ImagePath = system32\DRIVERS\QAssist.sys

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
services\QAssist
DisplayName = QAssist

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
services\QAssist
DependOnService = FltMgr

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
services\QAssist
SupportedFeatures = 3

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
services\QAssist
Hid_IgnoredImages = %System%\Services.exe

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
services\QAssist
Type = 2

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
services\QAssist
ErrorControl = 0

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
services\QAssist
Group = FSFilter Activity Monitor

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
services\QAssist
DebugFlags = 0

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
services\QAssist\Instances
DefaultInstance = QAssist Instance

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
services\QAssist\Instances\
QAssist Instance
Altitude = 370030

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
services\QAssist\Instances\
QAssist Instance
Flags = 0

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
services\瑞昱声卡相关辅助程序
Type = 16

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
services\瑞昱声卡相关辅助程序
Start = 2

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
services\瑞昱声卡相关辅助程序
ErrorControl = 0

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
services\瑞昱声卡相关辅助程序
ImagePath = %System%\Tlctl.exe -auto

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
services\瑞昱声卡相关辅助程序
DisplayName = 瑞昱声卡相关辅助程序

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
services\瑞昱声卡相关辅助程序
ObjectName = LocalSystem

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
services\瑞昱声卡相关辅助程序
Description = 瑞昱声卡相关辅助程序

Propagation

This Backdoor does not have any propagation routine.

Information Theft

This Backdoor gathers the following data:

• Record videos of the victim's Desktop
• Computer Name
• Username
• Local Hostname
• Local socketname
• System Information
• Volume Information

Stolen Information

This Backdoor sends the gathered information via HTTP POST to the following URL:

• 151.{BLOCKED}.{BLOCKED}.133:80
• 154.{BLOCKED}.{BLOCKED}.25:80

Other Details

This Backdoor does the following:

• %System%\drivers\QAssist.sys is used to hide the content of the process of "%System%\Tlctl.exe" and physical files.
• Check if running in 32 bit or 64 bit OS:
  • If running in 32 bit OS, it will drop a 32bit version of %System%\drivers\QAssist.sys.
  • If running in 64 bit OS, it will drop a 64bit version of %System%\drivers\QAssist.sys.
• It query to the following URL to know if it has internet connection:
  • 23.{BLOCKED}.{BLOCKED}.48:80
  • 23.{BLOCKED}.{BLOCKED}.42:80
• It listen to the following C&C to get the backdoor commands:
  • 47.{BLOCKED}.{BLOCKED}.233:80
  • 47.{BLOCKED}.{BLOCKED}.233:443
  • 151.{BLOCKED}.{BLOCKED}.133:80
  • 154.{BLOCKED}.{BLOCKED}.25:8080
• It connects to the following URL to get the C&C server:
  • http://www.taobao.com/help/getip.php
• It list the running process on the system and records if the following string is also found on the processes:
  • 360tray.exe
  • 360
  • 360sd.exe
  • kxetray.exe
  • KSafeTray.exe
  • QQPCRTP.exe
  • QQ
  • HipsTray.exe
  • BaiduSd.exe
  • baiduSafeTray.exe
  • KvMonXP.exe
  • RavMonD.exe
  • QUHLPSVC.EXE
  • QuickHeal
  • mssecess.exe
  • cfp.exe
  • Comodo
  • SPIDer.exe
  • DR.WEB
  • acs.exe
  • Outpost
  • V3Svc.exe
  • V3
  • AYAgent.axe
  • avgwdsvc.exe
  • AVG
  • f-secure.exe
  • F-Secure
  • avp.exe
  • Mcshield.exe
  • egui.exe
  • NOD32
  • knsdtray.exe
  • TMBMSRV.exe
  • avcenter.exe
  • ashDisp.exe
  • rtvscan.exe
  • remupd.exe
  • vsserv.exe
  • BitDefender
  • PSafeSysTray.exe
  • PSafe
  • ad-watch.exe
  • K7TSecurity.exe
  • K7
  • UnThreat.exe
  • UnThreat
• It has the following backdoor commands:
  • Get System infomation(Processor Name, OS Architecture)
  • Send information gathered
  • Add User Account
  • Execute shell command
  • Send a control code to as service
  • Create, Modify and Delete a Registry
  • Get Hostname
  • Set Remote Desktop connection
  • Create a File
  • Connect and Disconnect Remote Desktop
  • Terminate Thread
  • Enumerate User Account
  • List Local Group
  • Get User Account and password
  • Set parameters on a User Account
  • Retrieve List of sessions on Remote Desktop Session Host
  • Disconnect as session on Remote Desktop Session Host
• This Backdoor should run as a service to proceed to its malicious routine.

It does not exploit any vulnerability.

It adds the following scheduled tasks:

• • Task name:瑞昱声卡后台相关辅助程序
  • Actions: %Windows%\arphaCrashReport.exe
  • Trigger: At starup
  • Details: At System Startup - Trigger expires at 3015/15/02 8:00:00

(Note: %Windows% is the Windows folder, where it usually is C:\Windows on all Windows operating system versions.)