BKDR_NFLOG.ETS

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes commands from a remote malicious user, effectively compromising the affected system.

It executes the downloaded files. As a result, malicious routines of the downloaded files are exhibited on the affected system.

It deletes itself after execution.

Arrival Details

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This backdoor drops the following file(s)/component(s):

• %User Temp%\±ØÒª.pdf - Non-malicious PDF file
• %Temp%\NfIpv6.ocx - Also detected as BKDR_NFLOG.ETS
• %Temp%\YahooCache.ini
• %Temp%\checkup.exe - Also detected as BKDR_NFLOG.ETS

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.. %Temp% is the Windows Temporary folder, which is usually C:\Windows\Temp.)

It injects itself into the following processes as part of its memory residency routine:

• svchost.exe

Autostart Technique

This backdoor registers itself as a system service to ensure its automatic execution at every system startup by adding the following registry entries:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\IPRIP
Type = "20"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\IPRIP
Start = "2"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\IPRIP
ErrorControl = "1"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\IPRIP
ImagePath = "%SystemRoot%\System32\svchost.exe -k netsvcs"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\IPRIP
DisplayName = "IPv6 Stack Local Support"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\IPRIP
ObjectName = "LocalSystem"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\IPRIP
Description = "Net address translation for IPv6 Protocol."

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\IPRIP\Security
Security = "{hex values}"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\IPRIP\Parameters
ServiceDll = %Temp%\NfIpv6.ocx

Other System Modifications

This backdoor adds the following registry keys:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\IPRIP

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\IPRIP\Parameters

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\IPRIP\Security

HKEY_USERS\.DEFAULT\Software\
Microsoft\Windows\CurrentVersion\
Internet Settings\P3P

HKEY_USERS\.DEFAULT\Software\
Microsoft\Windows\CurrentVersion\
Internet Settings\P3P\History

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings\
5.0\Cache\Extensible Cache\
MSHist01{Current date and the date the day after}

It adds the following registry entries:

HKEY_USERS\.DEFAULT\Software\
Microsoft\Clock
HID = "{hex values}"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
WebView\BarricadedFolders
shell:Windows = "0"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings\
5.0\Cache\Extensible Cache\
MSHist01{Current date and the date the day after}
CachePath = "%USERPROFILE%\Local Settings\History\History.IE5\MSHist01{Current date and the date the day after}\"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings\
5.0\Cache\Extensible Cache\
MSHist01{Current date and the date the day after}
CachePrefix = ":{Current date and the date the day after}: "

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings\
5.0\Cache\Extensible Cache\
MSHist01{Current date and the date the day after}
CacheLimit = "2000"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings\
5.0\Cache\Extensible Cache\
MSHist01{Current date and the date the day after}
CacheOptions = "b"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings\
5.0\Cache\Extensible Cache\
MSHist01{Current date and the date the day after}
CacheRepair = "0"

HKEY_USERS\.DEFAULT\Software\
Microsoft\Windows\CurrentVersion\
Internet Settings\Connections
DefaultConnectionSettings = "{Hex Values}"

It deletes the following registry keys:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings\
5.0\Cache\Extensible Cache\
MSHist01{Default}

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings\
5.0\Cache\Extensible Cache\
MSHist012012110920121110

Backdoor Routine

This backdoor executes the following commands from a remote malicious user:

• Download files
• Perform remote shell
• Retrieve system information
• Update self

It connects to the following URL(s) to send and receive commands from a remote malicious user:

• http://{BLOCKED}t194.{BLOCKED}n.com/norton/Nfile.asp
• http://{BLOCKED}t194.{BLOCKED}n.com/norton/NfStart.asp
• http://{BLOCKED}t194.{BLOCKED}n.com/norton/TTip.asp
• http://{BLOCKED}t194.{BLOCKED}n.com/norton/NfHostInfo.as
• http://{BLOCKED}t194.{BLOCKED}n.com/norton/NfCommand.asp
• http://{BLOCKED}t194.{BLOCKED}n.com/norton/Nfpredown.asp

It posts the following information to its command and control (C&C) server:

• IP configuration
• Network statistics
• Running processes
• Running services
• System information

Download Routine

This backdoor accesses the following websites to download files:

• http://{BLOCKED}t194.{BLOCKED}n.com/norton/Nfile.asp

It saves the files it downloads using the following names:

• %Temp%\MSMAPI.OCX - Detected as BKDR_NFLOG.SM

(Note: %Temp% is the Windows Temporary folder, which is usually C:\Windows\Temp.)

It then executes the downloaded files. As a result, malicious routines of the downloaded files are exhibited on the affected system.

Other Details

This backdoor requires the existence of the following files to properly run:

• %Temp%\YahooCache.ini

(Note: %Temp% is the Windows Temporary folder, which is usually C:\Windows\Temp.)

It deletes itself after execution.

NOTES:

This backdoor reports system infection by sending IP address and infection time to the following URL via HTTP post:

• http://{BLOCKED}t194.8{BLOCKED}.com/norton/NfStart.asp

This backdoor opens the dropped non-malicious PDF file to trick users into thinking that the opened a normal PDF file.