BKDR_ANDROM.WEY

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes commands from a remote malicious user, effectively compromising the affected system.

It executes the downloaded files. As a result, malicious routines of the downloaded files are exhibited on the affected system.

Arrival Details

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This backdoor drops the following copies of itself into the affected system:

• %User Temp%\ms{random characters}.{extension name}
• %AppDataLocal%\Temp\ms{random}.{extension name} (Windows Vista and higher versions)
• %All Users Profile%\Local Settings\Temp\ms{random}.{extension name} (Versions lower than Windows Vista)

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.. %AppDataLocal% is the Local Application Data folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local on Windows Vista and 7.. %All Users Profile% is the All Users or Common profile folder, which is C:\Documents and Settings\All Users in Windows 2000, XP, and Server 2003, and C:\ProgramData in Windows Vista and 7.)

It stays memory-resident by injecting codes into the following processes:

• wuauclt.exe
• svchost.exe

Autostart Technique

This backdoor adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows NT\CurrentVersion\Windows
Load = "%User Temp%\ms{random}.{extension name}"

HKEY_CURRENT_USER\Software\Microsoft\
Windows NT\CurrentVersion\Windows
Load = "%AppDataLocal%\Temp\ms{random}.{extension name}" (Windows Vista and higher versions)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\policies\
Explorer\Run
{random number} = "%User Temp%\ms{random}.{extension name}"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\policies\
Explorer\Run
{random number} = "%All Users Profile%\Local Settings\Temp\ms{random}.{extension name}" (Versions lower than Windows Vista)

Backdoor Routine

This backdoor executes the following commands from a remote malicious user:

• Download a file directed by C&C server, save it as %User Temp%\{random number}.exe and execute it
• Download a file directed by C&C server, save it as %All Users Profile%\ms{random number}.dat and loads it
• Start a process
• Uninstall itself
• Remote shell commands

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.. %All Users Profile% is the All Users or Common profile folder, which is C:\Documents and Settings\All Users in Windows 2000, XP, and Server 2003, and C:\ProgramData in Windows Vista and 7.)

It connects to the following URL(s) to send and receive commands from a remote malicious user:

• http://{BLOCKED}gate.pw/skyload/skygate.php
• http://{BLOCKED}.{BLOCKED}.204.237/skyload/skygate.php

Download Routine

This backdoor accesses the following websites to download files:

• http://{BLOCKED}.{BLOCKED}.137.91/images/0/saner.exe
• http://{BLOCKED}.{BLOCKED}.137.91/images/0/0.dll

It saves the files it downloads using the following names:

• %User Temp%\{random number}.exe - detected as TROJ_SULUNCH.VI
• %All Users Profile%\ms{random number}.dat - detected as TSPY_FAREIT.WEY

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.. %All Users Profile% is the All Users or Common profile folder, which is C:\Documents and Settings\All Users in Windows 2000, XP, and Server 2003, and C:\ProgramData in Windows Vista and 7.)

It then executes the downloaded files. As a result, malicious routines of the downloaded files are exhibited on the affected system.

NOTES:

The {extension name} of the dropped copy is any of the following:

• bat
• cmd
• com
• exe
• pif
• scr