BKDR_KEYLOGGER.C

It sends the stolen information to a specific port via injected code in IEXPLORE.EXE.

After a successful connection to the server, it then waits for a command from the server. The commands received depend on the malware author/server's reply, it can be download command or any other command that can fit in its space in the memory. The download routine code is technically not on the malware file. But the server can send a download routine code which the malware could execute. However during testing no successful connection can be established. The port used by the malware may also change depending on the reply from the server.

This backdoor may be downloaded by other malware/grayware/spyware from remote sites. It may be unknowingly downloaded by a user while visiting malicious websites.

It opens a hidden instance of Internet Explorer to send stolen information to a certain site. It logs a user's keystrokes to steal information.

Arrival Details

This backdoor may be downloaded by other malware/grayware/spyware from remote sites.

It may be unknowingly downloaded by a user while visiting malicious websites.

Installation

This backdoor drops the following copies of itself into the affected system:

• %Windows%\crss.exe

(Note: %Windows% is the Windows folder, which is usually C:\Windows or C:\WINNT.)

It injects threads into the following normal process(es):

• IEXPLORE.EXE

Autostart Technique

This backdoor adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Cisco VPN Adapter = "%Windows%\crss.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Active Setup\Installed Components\{00F6F132-7AC8-1AF4-37B9-4B38E166CF65}
StubPath = "%Windows%\crss.exe"

Other System Modifications

This backdoor adds the following registry entries as part of its installation routine:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Active Setup\Installed Components\{00F6F132-7AC8-1AF4-37B9-4B38E166CF65}

Dropping Routine

This backdoor drops the following file(s), which it uses for its keylogging routine:

• %Windows%\crss

(Note: %Windows% is the Windows folder, which is usually C:\Windows or C:\WINNT.)

Information Theft

This backdoor opens a hidden instance of Internet Explorer to send stolen information to the following site:

• {BLOCKED}t.game-host.org

It logs a user's keystrokes to steal information.

Other Details

This backdoor does the following:

• It sends the stolen information at port 433 via injected code in IEXPLORE.EXE.
• After a successful connection to the server, it then waits for a command from the server. The commands received depend on the malware author/server's reply, it can be download command or any other command that can fit in its space in the memory. The download routine code is technically not on the malware file. But the server can send a download routine code which the malware could execute. However during testing no successful connection can be established. The port used by the malware may also change depending on the reply from the server.