BKDR_POSTBOT.C

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It does not have any propagation routine.

It executes commands from a remote malicious user, effectively compromising the affected system.

Arrival Details

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This backdoor adds the following mutexes to ensure that only one of its copies runs at any one time:

• nvkwer23gxdw

Other System Modifications

This backdoor adds the following registry entries:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer
MMID = "{random value}"

Propagation

This backdoor does not have any propagation routine.

Backdoor Routine

This backdoor executes the following commands from a remote malicious user:

• Enumerate all drives with corresponding drive types
• Enumerate files and directories
• Copy, move, rename, or delete files
• Create directories
• Create or terminate processes
• Copy %System%\cmd.exe as %User Temp%\ms1ng2d3d2.exe
• Perform remote shell
• Upload files to C&C server
• Download files from C&C server
• Execute the file %System%\msvid.exe with the parameter /u
• Execute the file %System%\msvid.exe with the parameter /g
• Sleep for a specified amount of time

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.)

It connects to the following URL(s) to send and receive commands from a remote malicious user:

• {C&C domain name}/{8 random characters}{hard-coded string}

NOTES:

This backdoor may use proxy connections by connecting to the URL {Proxy server name}:{Port Number}. The proxy server name and port number depends on the file {malware path}\mpc.dat. If the said file is not present, it uses the default proxy settings.

It accesses the URL http://{BLOCKED}-kogyo.jp/img/index.php to read its configuration.

Its configuration contains the C&C domain name information.However, as of this writing, the said URL is already inaccessible.

The hardcoded string can be any of the following:

• abdgry.php
• bxcvyi.php
• cxctgh.php
• dcfbht.php
• dkgwey.php
• ebhfyj.php
• fxvnht.php
• gbcjhg.php
• hcvery.php
• jxbrte.php
• mxdber.php
• ncxbre.php
• qfgget.php
• rxxree.php
• schrtu.php
• tbcfjr.php
• udbvnx.php
• vcvbfh.php
• whcfby.php
• xbfhyh.php
• ynhkef.php
• zgfhso.php

It does not have rootkit capabilities.

It does not exploit any vulnerability.