BKDR_BLADABIN.AB

This malware is involved in a socially-engineered attack tailored to take advantage of the upcoming FIFA 2014 World Cup in Brazil. As it exhibits backdoor routines, users affected by this malware may find the security of their systems compromised.

To get a one-glance comprehensive view of the behavior of this Backdoor, refer to the Threat Diagram shown below.

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes commands from a remote malicious user, effectively compromising the affected system.

Arrival Details

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This backdoor drops the following copies of itself into the affected system and executes them:

• %User Temp%\pls.exe

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.)

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• f3ef1d36b8ed15fcea19675640dc1fb9

Autostart Technique

This backdoor adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
f3ef1d36b8ed15fcea19675640dc1fb9 = ""%User Temp%\pls.exe" .."

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
f3ef1d36b8ed15fcea19675640dc1fb9 = ""%User Temp%\pls.exe" .."

Other System Modifications

This backdoor adds the following registry entries:

HKEY_CURRENT_USER\Environment
SEE_MASK_NOZONECHECKS = "1"

It creates the following registry entry(ies) to bypass Windows Firewall:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\AuthorizedApplications\
List
%User Temp%\pls.exe = "%User Temp%\pls.exe:*:Enabled:pls.exe"

Backdoor Routine

This backdoor executes the following commands from a remote malicious user:

• Download and execute files
• Compress files for uploading
• Load plugins
• Ping
• Registry management
• Perform remote shell
• Restart
• Capture screenshots
• Unistall itself
• Update itself
• Terminate itself

It connects to the following URL(s) to send and receive commands from a remote malicious user:

• {BLOCKED}her1.no-ip.biz:1177

Information Theft

This backdoor gathers the following data:

• Computer name
• User name
• OS version
• Date of installation
• Window title of open application