BKDR_CORKOW.VDH

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It runs certain commands that it receives remotely from a malicious user. Doing this puts the affected computer and information found on the computer at greater risk.

It retrieves specific information from the affected system.

It requires its main component to successfully perform its intended routine.

Arrival Details

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This backdoor adds the following mutexes to ensure that only one of its copies runs at any one time:

• Global\{GUID}

It injects codes into the following process(es):

• java.exe
• javaw.exe

Other System Modifications

This backdoor adds the following registry entries as part of its installation routine:

HKEY_CURRENT_USER\SOFTWARE\Intel\
{random}
{random} = "{hex values}" =

HKEY_CLASSES_ROOT\WbemScripting.SWbemLastError\CurVer\
{random}
{random} = "{hex values}" =

It adds the following registry keys as part of its installation routine:

HKEY_CURRENT_USER\SOFTWARE\Intel\
{random}

HKEY_CLASSES_ROOT\WbemScripting.SWbemLastError\CurVer\
{random}

Backdoor Routine

This backdoor executes the following command(s) from a remote malicious user:

• Download and execute other files
• Update itself
• Download configuration file
• Delete files
• Uninstall itself

It connects to the following URL(s) to send and receive commands from a remote malicious user:

• http://{BLOCKED}ov.biz/rtl/cef.php
• http://{BLOCKED}0.com/rtl/cef.php
• http://{BLOCKED}ov.biz/rtl/sign.php
• http://{BLOCKED}0.com/rtl/sign.php

Download Routine

This backdoor saves the files it downloads using the following names:

• %User Temp%\{random}.tmp

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.)

Information Theft

This backdoor injects itself into the following web browsers to monitor searches made by the user on the following search engines:

• iexplore.exe
• firefox.exe

It retrieves the following information from the affected system:

• Machine GUID
• OS Installation date
• OS version
• Volume information
• Computer Name

Other Details

This backdoor connects to the following URL(s) to check for an Internet connection:

• http://download.windowsupdate.com/
• http://windowsupdate.microsoft.com/

It requires its main component to successfully perform its intended routine.

NOTES:

This backdoor checks if it is executed using the following process:

• svchost.exe
• explorer.exe
• rundll32.exe