BKDR_NIOUPALE.E

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It deletes itself after execution.

Arrival Details

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This backdoor drops the following copies of itself into the affected system and executes them:

• %User Profile%\System\Library\mshost.exe (for Windows Vista and above)
• %Program Files%\Common Files\System\Library\mshost.exe (for Windows XP and below)

(Note: %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003, or C:\Users\{user name} on Windows Vista and 7.. %Program Files% is the Program Files folder, where it usually is C:\Program Files on all Windows operating system versions; C:\Program Files (x86) for 32-bit applications running on Windows 64-bit operating systems.)

It drops the following files:

• %User Profile%\System\Library\msid.dat (for Windows Vista and above)
• %Program Files%\Common Files\System\Library\msid.dat (for Windows XP and below)

(Note: %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003, or C:\Users\{user name} on Windows Vista and 7.. %Program Files% is the Program Files folder, where it usually is C:\Program Files on all Windows operating system versions; C:\Program Files (x86) for 32-bit applications running on Windows 64-bit operating systems.)

Autostart Technique

This backdoor registers itself as a system service to ensure its automatic execution at every system startup by adding the following registry entries:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\xnbmwess
ImagePath = "%Program Files%\Common Files\System\Library\mshost.exe" (for Windows XP and below)

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\xnbmwess
Start = "2" (for Windows XP and below)

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\xnbmwess
DisplayName = "Microsoft Windows Smart Storage Service" (for Windows XP and below)

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\xnbmwess\Security
Security = "{hex value}" (for Windows XP and below)

It adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
xnbmwess = "%User Profile%\System\Library\mshost.exe" (for Windows Vista and above)

Other System Modifications

This backdoor adds the following registry keys:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\xnbmwess (for Windows XP and below)

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\xnbmwess\Security (for Windows XP and below)

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\xnbmwess\Enum (for Windows XP and below)

Other Details

This backdoor connects to the following possibly malicious URL:

• http://sit.{BLOCKED}climb.com/main/image/adfu.gif

It deletes itself after execution.