BKDR_MEVADE.B

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This backdoor adds the following folders:

• %Program Files%\Tor
• %System%\config\systemprofile\Local Settings\Application Data\Windows Internet Name Service
• %System%\config\systemprofile\Local Settings\Application Data\Windows Internet Name Service\{random numbers}
• %Root%\Documents and Settings\LocalService\Application Data\tor
• %Root%\Documents and Settings\LocalService\Application Data\tor\lock
• %Root%\Documents and Settings\LocalService\Application Data\tor\state

(Note: %Program Files% is the default Program Files folder, usually C:\Program Files in Windows 2000, Server 2003, and XP (32-bit), Vista (32-bit), and 7 (32-bit), or C:\Program Files (x86) in Windows XP (64-bit), Vista (64-bit), and 7 (64-bit).. %System% is the Windows system folder, which is usually C:\Windows\System32.)

It drops the following component file(s):

• %System%\config\systemprofile\Local Settings\Application Data\Windows Internet Name Service\{random numbers}
• %System32\config\systemprofile\Local Settings\Application Data\Windows Internet Name Service\{random numbers}\{random numbers}.ct
• %System32\config\systemprofile\Local Settings\Application Data\Windows Internet Name Service\{random numbers}\{random numbers}.ph

(Note: %System% is the Windows system folder, which is usually C:\Windows\System32.)

It drops the following copies of itself into the affected system:

• %System%\config\systemprofile\Local Settings\Application Data\Windows Internet Name Service\wins.exe

(Note: %System% is the Windows system folder, which is usually C:\Windows\System32.)

Autostart Technique

This backdoor registers itself as a system service to ensure its automatic execution at every system startup by adding the following registry entries:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\tor
Type = "10"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\tor
Start = "2"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\tor
ImagePath = "%Program Files%\Tor\tor.exe"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\tor
DisplayName = "Tor Win32 Service"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\tor
ObjectName = "NT AUTHORITY\LocalService"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\tor
Description = "Provides an anonymous Internet communication system"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\Windows Internet Name Service
Type = "10"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\Windows Internet Name Service
Start = "2"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\Windows Internet Name Service
ImagePath = "%System%\config\systemprofile\Local Settings\Application Data\Windows Internet Name Service\wins.exe"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\Windows Internet Name Service
DisplayName = "Windows Internet Name Service"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\Windows Internet Name Service
Group = "netsvcs"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\Windows Internet Name Service
ObjectName = "LocalSystem"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\Windows Internet Name Service
Description = "Provides Internet Name Service"

Other System Modifications

This backdoor adds the following registry keys:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\tor

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\Windows Internet Name Service

Backdoor Routine

This backdoor connects to the following URL(s) to send and receive commands from a remote malicious user:

• {BLOCKED}o.{BLOCKED}1.se
• {BLOCKED}har.{BLOCKED}i.jp
• {BLOCKED}116695.{BLOCKED}x.net
• {BLOCKED}berg.{BLOCKED}c.de
• {BLOCKED}t-router41-readme.{BLOCKED}ssnetworking.net

NOTES:
This backdoor drops a TOR client %Program Files%\Tor\tor.exe. It uses the following parameters to perform routine:

• /I - For malware installation(please see above modifications)
• /R - Register the service

The malware will attempt to connect to the following Onion Addresses via TOR Network:

• {BLOCKED}ktcb3gudt3.onion
• {BLOCKED}6vxyhpeouy.onion
• {BLOCKED}n3rrxtknu6.onion
• {BLOCKED}dixp4qbzce.onion
• {BLOCKED}ijtdca2tsy.onion
• {BLOCKED}xqxscsmscx.onion
• {BLOCKED}wa5yzxewc3.onion
• {BLOCKED}gagyod22sc.onion
• {BLOCKED}g64gi6fk7b.onion
• {BLOCKED}foqy4acjv4.onion
• {BLOCKED}sfnmtn544p.onion
• {BLOCKED}24mj7m4e2o.onion
• {BLOCKED}2omakx655w.onion
• {BLOCKED}qbnm6vctar.onion