BKDR_PUSHDO.AWA

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes commands from a remote malicious user, effectively compromising the affected system.

Arrival Details

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This backdoor drops the following copies of itself into the affected system:

• %User Profile%\cofugpobomxy.exe

(Note: %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003, or C:\Users\{user name} on Windows Vista and 7.)

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• goqcgc85589
• cofugpobomxy

It injects threads into the following normal process(es):

• svchost.exe

Autostart Technique

This backdoor adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
cofugpobomxy = "%User Profile%\cofugpobomxy.exe"

Other System Modifications

This backdoor adds the following registry entries:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion
AppManagement = "{random values}"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion
cofugpobomxyzap = "{random values}"

Propagation

This backdoor uses any of the following Simple Mail Transfer Protocol (SMTP) servers:

• smtp.compuserve.com
• mail.airmail.net
• smtp.directcon.net
• smtp.sbcglobal.yahoo.com
• smtp.mail.yahoo.com
• smtp.live.com

Backdoor Routine

This backdoor may also compose messages that can be part of its spamming routine.

It executes the following commands from a remote malicious user:

• Download and execute files
• Get OS Version
• Get System Information
• Get Network Information
• Retrieve Spam Configuration/Content

It connects to the following URL(s) to send and receive commands from a remote malicious user:

• http://{BLOCKED}1.{BLOCKED}p.messagingengine.com

NOTES:

It performs random GET Request connection to the following URLs to mask outbound connections.

• 4pipp.com
• accel.lt
• aciuba.com.br
• acsmedioambiente.com
• adultlivechat.us
• aethora.com
• agrarno.ru
• aipi.co.nz
• al-mawared.com
• appelfarm.org
• arckepesajandek.hu
• area72aa.org
• {BLOCKED}j.co.jp
• atr-technologies.com
• avant-ime.com
• avisay.com
• beechwoodmetalworks.com
• berkshirebusiness.org
• bethisraelcenter.org
• bigtopmultimedia.com
• biurimex.pl
• bocr.cz
• brijindia.com
• business-edge.com
• {BLOCKED}u.com
• capitalcitytuxedo.com
• cgc-england.com
• childscope.com
• chocolatecovers.com
• choice-select.com
• coe.pku.edu.cn
• coketh.com
• colourprint.nl
• courtney.ca
• csmbc.org
• d-j-b.net
• d4drmedia.com
• dbcomponents.com
• debtrescueusa.com
• denville.ca
• dithd.com
• djkentaro.com
• dormfantasies.com
• e-storming.com
• easyformations.net
• egao.net
• enzoyrodrigo.com.br
• eomc.net
• eurasia.it
• ezmedi.com
• fastarchofamerica.com
• figabara.com
• fleshercorp.com
• floridadoubled.com
• fruitspot.co.za
• gablemarine.com
• gcs-cpa.com
• genmar.gen.tr
• ginalimo.com
• glmghotels.com
• graceweb.net
• graintrain.coop
• guberman.com.br
• hartmultimedia.com
• hifuken.com
• hinnenwiese.de
• hostphd.com.br
• hoyuu.com
• hpp-services.com
• iaiglobal.or.id
• ibcd.com.br
• icigrain.com
• ixtractor.com
• jeangatz.com
• jeansmate.co.jp
• justconnect.co.za
• kamaruka.vic.edu.au
• korta-sa.com
• krafthaus.com
• kurecci.or.jp
• kvadratoff.ru
• le-mariage.com
• leadershipforum.us
• lexjuridica.com
• link-list-uk.com
• malagacorp.com
• mandi-man.com
• mastergrp-spb.ru
• mattiussiecologia.com
• merceorti.com
• meridies.org
• meubles-jacquelin.com
• miltinio-teatras.lt
• minatech.net
• msasys.com
• nanfangcw.com
• nasz-sklep.pl
• nd-evenementiel.com
• neurotoxininstitute.com
• nichedictionary.com
• ompgp.co.jp
• osouji-school.com
• paintball.be
• paulrenna.com
• {BLOCKED}sion.co.in
• phototype.com
• pixemia.com
• re-wakefield.co.uk
• realtechre.com
• rovoneli.com
• rueggeberg.com
• saios.net
• {BLOCKED}or.pl
• servico-ind.com
• shs-sales.co.uk
• sigmametalsinc.com
• solutioncorp.com
• sortedorganizing.com
• spiti.org
• stecom.nl
• steelpennygames.com
• stepnet.de
• stormwildlifeart.com
• sullyfrance.com
• sun-ele.co.jp
• szostka.com
• taykon.com
• thedonaldsongroup.com
• theprintinghouseltd.co.uk
• tollefsondesign.com
• {BLOCKED}meuse.com
• trenpalau.com
• trinity-works.com
• tss.org
• tutuji-saitama.com
• unitedearthgroup.com
• unslp.edu.bo
• vbwgz.com
• victoria.com.pl
• violadagamba.com
• westhillsstl.org
• wildrosemarketing.com
• wkhk.net
• www.traderush.com
• xuanxiao.com
• yamamoto-sr.com

It performs random POST Request connection to the following URLs to mask outbound connections:

• acicinvestor.ca
• acmepacificrepairs.com
• actfactory.net
• agence-des-druides.com
• altonhousehotel.com
• ans-service.com
• areafor.com
• arquiteturadigital.com
• asterisk.com.sg
• audio-direkt.net
• austriansurfing.at
• authentica-travel.com
• bapasitaramsevatrust.org
• bigjohnsbeefjerky.com
• bredainternet.nl
• brookfarm.com.au
• cabooseonline.com
• cath4choice.org
• cbsprinting.com.au
• celebikalip.com.tr
• christybarry.com
• chscreative.com
• churchsupplies.net
• cksglobal.net
• combine.or.id
• coopsupermarkt.nl
• ctr4process.org
• doctsf.com
• eleterno.com
• empordalia.com
• espace-hotelier.com
• etcycles.com
• eyggroup.com
• fabianonline.de
• fraser-high.school.nz
• frederickallergy.com
• freepatentauction.com
• gamblingonlinemagazine.com
• geodecisions.com
• geothermusa.com
• gjk.com.pl
• golfpark-moossee.ch
• goodvaluecenter.com
• impex.com.pl
• isle-karnataka.org
• isp-h.com
• istanbultarim.com.tr
• kafrit.com
• konishi-hp.com
• macgregor.co.kr
• mail57.us2.mcsv.net
• manuyantralaya.com
• mastechn.com
• mojacar-vacaciones.com
• momonophoto.com
• myfilecenter.com
• {BLOCKED}urus.com
• nataliecurtiss.com
• nazcapictures.com
• norakuroya.com
• nori-k.com
• nuritech.com
• optiver.com.au
• pbna.com
• pcpeds.com
• perc.ca
• photoclubs.com
• racknstackwarehouse.com.au
• rewardhits.com
• rodeoshow.com.au
• ryumachi-jp.com
• safetyconnection.ca
• sarahdavid.com
• sarpy.com
• schiedel.it
• screaminpeach.com
• sdlp.ie
• shakeyspizza.ph
• shbrazil.com
• sspackaginggroup.com
• structives.org
• sztartufi.com
• tavdi.com
• teasing-video.com
• telenavis.com
• tessera.co.jp
• theartofhair.com
• theautospas.com
• thesergery.com
• timeturkey.com
• toddpipe.com
• topex.ro
• totalearthcare.com.au
• upsilon89.com
• urantiaproject.com
• urayasu.net
• vanguardpkg.com
• woodlandhillwinery.com
• wsipowerontheweb.com
• www.traderush.com
• x-cellcommunications.de
• xing-group.com
• ziuabarbatului.ro

It does not have rootkit capabilities.

It does not exploit any vulnerability.