BKDR_MAKADOCS.JG

This malware targets Windows 8 users and uses Google Docs for its C and C communication to prevent easy detection and removal.

To get a one-glance comprehensive view of the behavior of this Backdoor, refer to the Threat Diagram shown below.

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes commands from a remote malicious user, effectively compromising the affected system.

It retrieves specific information from the affected system.

Arrival Details

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This backdoor adds the following mutexes to ensure that only one of its copies runs at any one time:

• G46A33F21110

Backdoor Routine

This backdoor executes the following commands from a remote malicious user:

• Terminate itself
• Download and execute files
• Change IP
• Open command line

Information Theft

This backdoor retrieves the following information from the affected system:

• Current folder path
• Domain admin
• Domain name
• GUID
• Host name
• Local admin
• OS build version
• User name
• Windows base version
• Windows version

NOTES:

This backdoor uses the following URL as its proxy server to connect to its C&C to avoid detection:

• https://docs.google.com