BKDR_ANDROM.CRO
Backdoor.Win32.Androm.fqwl (Kaspersky), VirTool:Win32/VBInject (Microsoft), Win32/TrojanDownloader.Wauchos.AF trojan (ESET)
Windows
Threat Type: Backdoor
Destructiveness: No
Encrypted:
In the wild: Yes
OVERVIEW
This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.
TECHNICAL DETAILS
Arrival Details
This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.
Installation
This backdoor drops the following copies of itself into the affected system:
- %All Users Profile%\ms{random}.exe
(Note: %All Users Profile% is the All Users folder, where it usually is C:\Documents and Settings\All Users on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\ProgramData on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)
Autostart Technique
This backdoor adds the following registry entries to enable its automatic execution at every system startup:
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\policies\
Explorer\Run
{random number} = "%All Users Profile%\ms{random}.exe"
Other System Modifications
This backdoor adds the following registry entries:
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\policies\
Explorer
TaskbarNoNotification = "0"
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\policies\
Explorer
TaskbarNoNotification = "0"
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\policies\
Explorer
HideSCAHealth = "0"
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\policies\
Explorer
HideSCAHealth = "0"
It modifies the following registry entries:
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
ShowSuperHidden = "0"
(Note: The default value data of the said registry entry is 1.)
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
Hidden = "2"
(Note: The default value data of the said registry entry is 1.)
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\policies\
system
EnableLUA = "0"
Other Details
This backdoor connects to the following possibly malicious URL:
- http://{BLOCKED}o.net/index.php
- http://{BLOCKED}rf.net/index.php
- http://{BLOCKED}s.su/index.php
- http://{BLOCKED}o.com/index.php