BKDR_ALDIBOT.C

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes commands from a remote malicious user, effectively compromising the affected system. It connects to a website to send and receive information.

Arrival Details

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This backdoor drops the following copies of itself into the affected system and executes them:

• %Application Data%\nvsvc32.exe

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.)

Autostart Technique

This backdoor adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NVidia Physx Service = "%Application Data%\nvsvc32.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
NVidia Physx Service = "%Application Data%\nvsvc32.exe"

Other System Modifications

This backdoor adds the following registry keys:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Active Setup\Installed Components\{random}

It adds the following registry entries:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Active Setup\Installed Components\{random}
NVidia Physx Service = ""%Application Data%\nvsvc32.exe /ActiveX""

Backdoor Routine

This backdoor executes the following commands from a remote malicious user:

• StartHTTP - starts an HTTP DDoS attack
• StartTCP - starts a TCP DDoS attack
• StopHTTPDDoS - stops an HTTP DDoS attack
• StopTCPDDoS - stops a TCP DDoS attack
• StopDDoS - stops all DDoS attack
• DownloadEx - downloads and executes file
• CreateSocks - creates SOCKS5 proxy
• StealData - performs password stealing capability
• Update - updates itself

It connects to the following websites to send and receive information:

• http://{BLOCKED}e.{BLOCKED}b.com/tt/gate.php?hwid={HWID}&pc={Host Name}&localip={Local IP Address}&winver={OS Version}

Information Theft

This backdoor gathers the following data:

• Hardware Identification (HWID)
• Host Name
• Local IP Address
• OS Version

It attempts to get stored information such as user names, passwords, and hostnames from the following browsers:

• Mozilla Firefox

NOTES:

It steals information such as user names and passwords from the following application:

• Pidgin
• jDownloader

It also uses the following as its User-Agent:

• Aldi Bot FTW :D