BKDR_BVOK.SS

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes commands from a remote malicious user, effectively compromising the affected system. It connects to a website to send and receive information.

It deletes the initially executed copy of itself.

Arrival Details

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This backdoor drops the following copies of itself into the affected system and executes them:

• %System%\{random}.exe

(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.)

Autostart Technique

This backdoor registers itself as a system service to ensure its automatic execution at every system startup by adding the following registry entries:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Enum\Root\LEGACY_XINSHIJI
NextInstance = "1"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Enum\Root\LEGACY_XINSHIJI\
0000
Service = "XinShiJi"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Enum\Root\LEGACY_XINSHIJI\
0000
Legacy = "1"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Enum\Root\LEGACY_XINSHIJI\
0000
ConfigFlags = "0"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Enum\Root\LEGACY_XINSHIJI\
0000
Class = "LegacyDriver"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Enum\Root\LEGACY_XINSHIJI\
0000
ClassGUID = "{8ECC055D-047F-11D1-A537-0000F8753ED1}"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Enum\Root\LEGACY_XINSHIJI\
0000
DeviceDesc = "Remote Cimder Cooler"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Enum\Root\LEGACY_XINSHIJI\
0000\Control
*NewlyCreated* = "0"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Enum\Root\LEGACY_XINSHIJI\
0000\Control
ActiveService = "XinShiJi"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\XinShiJi
Type = "0"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\XinShiJi
Start = "2"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\XinShiJi
ErrorControl = "0"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\XinShiJi
ImagePath = "%System%\{random}.exe"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\XinShiJi
DisplayName = "Remote Cimder Cooler"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\XinShiJi
ObjectName = "LocalSystem"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\XinShiJi
Description = "Windows Resource Member"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\XinShiJi\Security
Security = "{hex}"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\XinShiJi\Enum
0 = "Root\LEGACY_XINSHIJI\0000"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\XinShiJi\Enum
Count = "1"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\XinShiJi\Enum
NextInstance = "1"

It registers as a system service to ensure its automatic execution at every system startup by adding the following registry keys:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Enum\Root\LEGACY_XINSHIJI

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Enum\Root\LEGACY_XINSHIJI\
0000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Enum\Root\LEGACY_XINSHIJI\
0000\Control

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\XinShiJi

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\XinShiJi\Security

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\XinShiJi\Enum

Other System Modifications

This backdoor creates the following registry entry(ies) to bypass Windows Firewall:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\AuthorizedApplications\
List
%System%\{random}.exe = "%System%\{random}.exe:*:Enabled:Microsoft (R) Internetal IExplore"

Backdoor Routine

This backdoor opens the following port(s) where it listens for remote commands:

• 8080

It executes the following commands from a remote malicious user:

• Download and execute a file
• Delete, Move or Copy a file from the computer
• Shutdown and power off the computer
• Get drive type
• Execute remote commands

It connects to the following websites to send and receive information:

• Computer name
• OS version
• CPU model
• Physical RAM

It connects to the following URL(s) to send and receive commands from a remote malicious user:

• {BLOCKED}jiwang.net

Other Details

This backdoor deletes the initially executed copy of itself