BKDR_IRCBOT.HIK

This backdoor uses social engineering methods to lure users into performing certain actions that may, directly or indirectly, cause malicious routines to be performed. Specifically, it arrives as a dating spam attachment that bears the .SCR extension.

To get a one-glance comprehensive view of the behavior of this Backdoor, refer to the Threat Diagram shown below.

This backdoor arrives as an attachment to email messages spammed by other malware/grayware or malicious users.

Arrival Details

This backdoor arrives as an attachment to email messages spammed by other malware/grayware or malicious users.

Installation

This backdoor drops the following copies of itself into the affected system:

• %System%\{random name of a file found in this folder}{random letter}.exe

(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.)

It drops the following files:

• %System%\1477908159.dat - non-malicious file

(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.)

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• 9LZZ1TXjZ5NHrnf71f

Autostart Technique

This backdoor adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Run
Win32Update = "{random name of a file found in the Windows system folder}{random letter}.exe"

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\RunServices
Win32Update = "{random name of a file found in the Windows system folder}{random letter}.exe"

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\RunServices
Win32Update = "{random name of a file found in the Windows system folder}{random letter}.exe"

HKEY_LOCAL_MACHINE\Software\Microsoft\
OLE
Win32Update = "{random name of a file found in the Windows system folder}{random letter}.exe"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\Lsa
Win32Update = "{random name of a file found in the Windows system folder}{random letter}.exe"

Backdoor Routine

This backdoor opens the following port(s) where it listens for remote commands:

• TCP port 6667

It connects to any of the following IRC server(s):

• #AllNiteCafe

It connects to the following URL(s) to send and receive commands from a remote malicious user:

• {BLOCKED}.{BLOCKED}.135.174

NOTES:

It can possibly execute the following command(s) from a remote malicious user:

• Download and execute an updated copy of itself or other malware
• Gather system information
• Start and stop services