BKDR_MATSNU.AC

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes commands from a remote malicious user, effectively compromising the affected system.

It deletes itself after execution.

Arrival Details

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This backdoor drops the following copies of itself into the affected system:

• %User Temp%\{random folder name}\{random filename 1}.exe
• %User Temp%\{random filename 2}.pre - deleted afterwards

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.)

It creates the following folders:

• %User Temp%\{random folder name}

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.)

It injects codes into the following process(es):

• svchost.exe
• ctfmon.exe
• explorer.exe

Autostart Technique

This backdoor adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
{random} = "%User Temp%\{random folder name}\{random file name 1}.exe"

Other System Modifications

This backdoor adds the following registry keys:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
taskmgr.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
msconfig.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
regedit.exe

HKEY_CURRENT_USER\SOFTWARE\Microsoft\
Windows\CurrentVersion\Policies\
System

It adds the following registry entries:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\
Windows\CurrentVersion\Policies\
System
DisableRegistryTools = "1"

HKEY_CURRENT_USER\SOFTWARE\Microsoft\
Windows\CurrentVersion\Policies\
System
DisableRegedit = "1"

HKEY_CURRENT_USER\SOFTWARE\Microsoft\
Windows\CurrentVersion\Policies\
System
DisableTaskMgr = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\policies\
system
DisableRegedit = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\policies\
system
DisableTaskMgr = "1"

It deletes the following registry keys:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Network

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Minimal

Backdoor Routine

This backdoor executes the following commands from a remote malicious user:

• Download and execute/load arbitrary files
• Update itself
• Update C&C servers
• Delete ntldr and ntdetect.com, then wipe MBR
• Lock/unlock computer for ransom

It posts the following information to its command and control (C&C) server:

• Disk serial number
• Attack status
• Location
• OS version

Other Details

This backdoor connects to the following possibly malicious URL:

• http://{BLOCKED}sscorn.net/TPR0-QQWSKA-423PZS.php
• http://{BLOCKED}olderx.net/TPR0-QQWSKA-423PZS.php
• http://p{BLOCKED}tory.net/TPR0-QQWSKA-423PZS.php
• http://{BLOCKED}olderxx.com/ag.php
• http://{BLOCKED}xf.com/TPR0-QQWSKA-423PZS.php
• http://{BLOCKED}rz.com/TPR0-QQWSKA-423PZS.php
• http://{BLOCKED}xrz.com/TPR0-QQWSKA-423PZS.php
• http://{BLOCKED}hppf.com/TPR0-QQWSKA-423PZS.php
• http://{BLOCKED}wieg.com/TPR0-QQWSKA-423PZS.php
• http://{BLOCKED}vw.com/TPR0-QQWSKA-423PZS.php
• http://{BLOCKED}vsje.com/TPR0-QQWSKA-423PZS.php
• http://{BLOCKED}dv.com/img/1.php

It deletes itself after execution.

NOTES:

This backdoor terminates itself if it finds the string sand-box in its file path. It displays the following message box: