BKDR_MECIV.AF

Both malware are related to the modified Enfal variants, which were reported to have infected 874 systems in 33 countries.

To get a one-glance comprehensive view of the behavior of this Backdoor, refer to the Threat Diagram shown below.

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. It may be dropped by other malware.

It connects to a website to send and receive information.

It deletes itself after execution.

Arrival Details

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It may be dropped by the following malware:

• TROJ_ARTIEF.JN

Installation

This backdoor drops the following component file(s):

• %System%\datac1en.dll - detected as BKDR_MECIV.AF

(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.)

Its DLL component is injected to the following process(es):

• svchost.exe

Autostart Technique

This backdoor registers itself as a system service to ensure its automatic execution at every system startup by adding the following registry entries:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WmdmPmSp
ImagePath = "%SystemRoot%\System32\svchost.exe -k netsvcs"

Other System Modifications

This backdoor adds the following registry entries as part of its installation routine:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WmdmPmSp\Parameters
ServiceDll = "%SystemRoot%\System32\datac1en.dll"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WmdmPmSp\Security
Security = "{Random Numbers}"

Backdoor Routine

This backdoor connects to the following websites to send and receive information:

• http://home.{BLOCKED}ibus.com

It posts the following information to its command and control (C&C) server:

• Hostname
• MAC address
• IP address
• Operating System
• File name of the malicious executable
• Campaign name

Other Details

This backdoor does the following:

• Downloads and execute other malware
• List files from a specific directory
• Terminate processes
• Update its C&C servers

It deletes itself after execution.

NOTES:

It sends the information to its C&C server using the following format:

• http://home.{BLOCKED}ibus.com/%7b{Campaign name 1}/{Campaign name 2}/{HostName:MAC Address}/{Campaign name 3}