BKDR_GRAVITYRAT.A

This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It connects to a website to send and receive information.

Arrival Details

This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Backdoor creates the following folders:

• %AppDataLocal%\Microsoft\Sys_Files
• %AppDataLocal%\Microsoft\002\003

(Note: %AppDataLocal% is the Application Data folder found in Local Settings, where it is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

Backdoor Routine

This Backdoor connects to the following websites to send and receive information:

• http://{BLOCKED}date.{BLOCKED}pdates.com:46769/Gvty@/1ns3rt_39291384.php
• http://{BLOCKED}tes.{BLOCKED}soft.com:46769/Gvty@/1ns3rt_39291384.php
• http://{BLOCKED}server.{BLOCKED}pdates.eu:46769/Gvty@/1ns3rt_39291384.php

Dropping Routine

This Backdoor drops the following files:

• %AppDataLocal%\Microsoft\Sys_Files\c#$k.txt - infection marker of the backdoor

(Note: %AppDataLocal% is the Application Data folder found in Local Settings, where it is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

It drops the following file, into which it saves gathered information:

• %AppDataLocal%\Microsoft\Sys_Files\$K&n.txt - contains the names of all files with specific extensions in the affected system
• %AppDataLocal%\Microsoft\Sys_Files\fupld.txt - files uploaded to the C&C server
• %AppDataLocal%\Microsoft\Sys_Files\ftoup.txt - files to be uploaded to the C&C server
• %AppDataLocal%\Microsoft\Sys_Files\fupva.txt - number of uploaded files

(Note: %AppDataLocal% is the Application Data folder found in Local Settings, where it is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

Download Routine

This Backdoor saves the files it downloads using the following names:

• %AppDataLocal%\Microsoft\002\003\{Payload Name}

(Note: %AppDataLocal% is the Application Data folder found in Local Settings, where it is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

Information Theft

This Backdoor gathers the following data:

• MAC Address
• PC Name
• Username
• IP Address
• Current Date
• Files with the following extensions in all fixed drives:
  • .docx
  • .doc
  • .pptx
  • .ppt
  • .xlsx
  • .xls
  • .rtf
  • .pdf

Other Details

This Backdoor connects to the following URL(s) to get the affected system's IP address:

• http://{BLOCKED}.{BLOCKED}.153.99:46769/Gvty@/ip.php