BKDR_CYGATE.A

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It logs a user's keystrokes to steal information.

However, as of this writing, the said sites are inaccessible.

Arrival Details

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This backdoor drops the following files:

• %User Temp%\UuU.uUu - contains the local time
• %User Temp%\XxX.xXx - contains the local time

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003.)

It drops the following copies of itself into the affected system:

• %System Root%\directory\cybergate\install\server.exe

(Note: %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.)

It creates the following folders:

• %System Root%\directory
• %System Root%\directory\cybergate
• %System Root%\directory\cybergate\install

(Note: %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.)

It injects codes into the following process(es):

• explorer.exe

Autostart Technique

This backdoor adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
Explorer\Run
Policies = %System Root%\directory\cybergate\install\server.exe

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Windows Defender = %System Root%\directory\cybergate\install\server.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Active Setup\Installed Components\{WEXDK158-5378-2A21-UNMH-4O16OEXKYMT3}
StubPath = %System Root%\directory\cybergate\install\server.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\policies\
Explorer\Run
Policies = %System Root%\directory\cybergate\install\server.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Windows Defender = %System Root%\directory\cybergate\install\server.exe

Other System Modifications

This backdoor adds the following registry keys:

HKEY_CURRENT_USER\Software\gianni

It adds the following registry entries as part of its installation routine:

HKEY_CURRENT_USER\Software\gianni
FirstExecution = {values}

HKEY_CURRENT_USER\Software\gianni
NewIdentification = {values}

HKEY_CURRENT_USER\Software\gianni
NewGroup = {values}

Backdoor Routine

This backdoor connects to the following URL(s) to send and receive commands from a remote malicious user:

• {BLOCKED}y.{BLOCKED}o.org:82

Dropping Routine

This backdoor drops the following file(s), which it uses for its keylogging routine:

• %User Profile%\Application Data\cglogs.dat - log file that contains encrypted, stolen information

(Note: %User Profile% is the current user's profile folder, which is usually C:\Windows\Profiles\{user name} on Windows 98 and ME, C:\WINNT\Profiles\{user name} on Windows NT, and C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003.)

Information Theft

This backdoor logs a user's keystrokes to steal information.

Other Details

This backdoor connects to the following possibly malicious URL:

• http://{BLOCKED}b.{BLOCKED}e4919.com/temp/www/z.php?t=

However, as of this writing, the said sites are inaccessible.

NOTES:
It gathers the following information from the affected system:

• WAN/LAN IP address
• Username
• Operating System
• CPU Information
• Installed Antivirus Software
• Firewall Information
• Active Window
• Available Webcam
• Geographical Location

It opens a hidden browser window in order to establish a connection to its C&C server.

It is capable of executing the following commands:

• Alter DNS settings to redirect the user to possibly malicious site(s)
• Scan for active ports
• Manipulate files, registries, programs, and Startup manager
• List and retrieve information of processes, active windows, services, installed programs, and devices
• Steal Google Chrome credentials
• Open a remote desktop
• Capture webcam
• Capture audio
• Steal user passwords from various applications
• Open Socks proxy
• Open HTTP proxy
• Open a website
• Download and execute file(s)
• Open command shell
• Execute DOS commands
• Search files or specific words from keylogged data
• Open a remote chat client
• Prompt a message box
• Update itself
• Perform Ping request
• Rename its filename
• Connect to a site and port
• Disconnect the itself
• Uninstall itself