BKDR_HEARTB.A

This backdoor may be dropped by other malware.

It opens a hidden Internet Explorer window. It executes commands from a remote malicious user, effectively compromising the affected system.

It deletes the initially executed copy of itself.

Arrival Details

This backdoor may be dropped by the following malware:

• TROJ_ARTIEF.ABF
• TROJ_ARTIEF.NADA

Installation

This backdoor drops the following copies of itself into the affected system and executes them:

• %User Temp%\netsh.exe

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003.)

It drops the following component file(s):

• %User Temp%\netsh.ini
• %User Temp%\netsh.dll - also detected as BKDR_HEARTB.A

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003.)

Its DLL component is injected to the following process(es):

• iexplore.exe

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• netsh Is Running!
• NetSharkV6 Is Running!

Autostart Technique

This backdoor drops the following shortcut pointing to its copy in the User Startup folder to enable its automatic execution at every system startup:

• %User Startup%\netsh.lnk

(Note: %User Startup% is the current user's Startup folder, which is usually C:\Windows\Profiles\{user name}\Start Menu\Programs\Startup on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Start Menu\Programs\Startup on Windows NT, and C:\Documents and Settings\{User name}\Start Menu\Programs\Startup.)

Backdoor Routine

This backdoor opens a hidden Internet Explorer window.

It executes the following commands from a remote malicious user:

• Copy, move, rename, delete files and folders
• Create files
• Enumerate files and folders
• Enumerate processes
• Enumerate services
• Execute files
• Get drive information
• Get file information
• Get process information
• Get service information
• Logoff system
• Modify files
• Modify service configuration
• Open files
• Perform remote shell
• Reboot system
• Shutdown system
• Start services
• Terminate processes
• Uninstall self from system
• Update self

It connects to the following URL(s) to send and receive commands from a remote malicious user:

• http://{BLOCKED}.{BLOCKED}.77.96

It posts the following information to its command and control (C&C) server:

• OS version information

Other Details

This backdoor deletes the initially executed copy of itself