BKDR_KULUOZ.YYLC

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes commands from a remote malicious user, effectively compromising the affected system.

Arrival Details

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This backdoor drops the following copies of itself into the affected system:

• %AppDataLocal%\{random file name}.exe

(Note: %AppDataLocal% is the Application Data folder found in Local Settings, where it is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

It adds the following processes:

• svchost.exe

It injects itself into the following processes running in the affected system's memory:

• created svchost.exe

Autostart Technique

This backdoor adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
{random} = "%AppDataLocal%\{random file name}.exe"

Other System Modifications

This backdoor adds the following registry keys:

HKEY_CURRENT_USER\Software\{random}

It adds the following registry entries:

HKEY_CURRENT_USER\Software\{random}
{random} = "{hex value}"

Backdoor Routine

This backdoor executes the following commands from a remote malicious user:

• Sleep/Idle
• Download and execute arbitrary file
• Uninstall itself
• Download module and inject to svchost.exe
• Update itself
• Check latest malware version
• Manage registry

It connects to the following URL(s) to send and receive commands from a remote malicious user:

• http://{BLOCKED}.{BLOCKED}.220.66:443/index.php
• http://{BLOCKED}.{BLOCKED}.119.209:8080/index.php
• http://{BLOCKED}.{BLOCKED}.122.237:8080/index.php
• http://{BLOCKED}.{BLOCKED}.212.241:8080/index.php
• http://{BLOCKED}.{BLOCKED}.6.80:8080/index.php
• http://{BLOCKED}.{BLOCKED}.62.149:8080/index.php
• http://{BLOCKED}.{BLOCKED}.75.58:8080/index.php
• http://{BLOCKED}.{BLOCKED}.29.172:8080/index.php

Information Theft

This backdoor gathers the following data:

• Malware version
• Virtualization information
• Running debugger/forensic tools
• User name
• Local IP address
• Processor type
• OS version
• Antivirus product
• Firewall product

NOTES:

This backdoor displays the following message in order to trick the users that the file is not able to execute:

It checks for running windows with the following names:

• 99929D61-1338-48B1-9433-D42A1D94F0D2
• 99929D61-1338-48B1-9433-D42A1D94F0D2-x32
• 99929D61-1338-48B1-9433-D42A1D94F0D2-x64
• APISpy32Class
• Dumper
• Dumper64
• iptools.exe
• Iris - Version 5.59
• prl_cc.exe
• prl_tools.exe
• ProcessHacker
• ProcessLasso_Notification_Class
• PROCEXPL
• PROCMON_WINDOW_CLASS
• SharedIntApp.exe
• Tfrmrpcap
• TSystemExplorerTrayForm.UnicodeClass
• VBoxService.exe
• VBoxTray.exe
• vmsrvc.exe
• vmtoolsd.exe
• vmusrvc.exe
• VMwareDragDetWndClass
• VMwareSwitchUserControlClass
• WdcWindow
• wireshark.exe

It checks Service Disk or BIOS for the following registry information if it is running in a virtual machine:

• AMIBI
• PTLTD
• Vbox
• Virtual
• VMware

It also checks if the following registry keys exist:

• HARDWARE\ACPI\DSDT\AMIBI
• HARDWARE\ACPI\DSDT\PTLTD__
• HARDWARE\ACPI\DSDT\VBOX__
• SYSTEM\CurrentControlSet\Enum\PCI\VEN_15AD&DEV_0774&SUBSYS_040515AD&REV_00
• SYSTEM\CurrentControlSet\Enum\PCI\VEN_15AD&DEV_0774&SUBSYS_074015AD&REV_00
• SYSTEM\CurrentControlSet\Enum\PCI\VEN_5333&DEV_8811&SUBSYS_00000000&REV_00
• SYSTEM\CurrentControlSet\Enum\PCI\VEN_80EE&DEV_BEEF&SUBSYS_00000000&REV_00
• SYSTEM\CurrentControlSet\Enum\PCI\VEN_80EE&DEV_CAFE&SUBSYS_00000000&REV_00