BKDR_PUSHDO.QW

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This backdoor drops the following copies of itself into the affected system:

• %User Profile%\{random filename}.exe

(Note: %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003, or C:\Users\{user name} on Windows Vista and 7.)

Autostart Technique

This backdoor adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
{random filename} = "%User Profile%\{random filename}.exe"

Other System Modifications

This backdoor adds the following registry entries:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion
AppManagement = "{random value}"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion
{random filename} = "{random value}"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion
{random number} = "{random value}"

HKEY_CURRENT_USER\Software\WinRAR
HWID = "{random value}"

HKEY_CURRENT_USER\Software\WinRAR
Client Hash = "{random value}"

Other Details

This backdoor connects to the following possibly malicious URL:

• {BLOCKED}p.com
• {BLOCKED}chitectural.com
• {BLOCKED}derwriters.com
• {BLOCKED}d.org
• {BLOCKED}l.lt
• {BLOCKED}investor.ca
• {BLOCKED}ba.com.br
• {BLOCKED}owledgements.net
• {BLOCKED}pacificrepairs.com
• {BLOCKED}actory.net
• {BLOCKED}nfire.com
• {BLOCKED}tehaus-sylt.de
• {BLOCKED}liatedinc.com
• {BLOCKED}ce-des-druides.com
• {BLOCKED}rno.ru
• {BLOCKED}ise.com
• {BLOCKED}andertg.com
• {BLOCKED}.gmail-smtp-in.l.google.com
• {BLOCKED}nhousehotel.com
• {BLOCKED}sciatorivenezia.com
• {BLOCKED}lemails.com
• {BLOCKED}service.com
• {BLOCKED}lfarm.org
• {BLOCKED}iplan.cl
• {BLOCKED}epesajandek.hu
• {BLOCKED}iteturadigital.com
• {BLOCKED}co.jp
• {BLOCKED}asli.com
• {BLOCKED}risk.com.sg
• {BLOCKED}rgo.com
• {BLOCKED}saviationinc.com
• {BLOCKED}ence-web.net
• {BLOCKED}o-direkt.net
• {BLOCKED}ardener.com.au
• {BLOCKED}t-ime.com
• {BLOCKED}ay.com
• {BLOCKED}cusa.com
• {BLOCKED}s1st.com
• {BLOCKED}vigna.com
• {BLOCKED}ia.net
• {BLOCKED}tl.net
• {BLOCKED}isj.com
• {BLOCKED}techinc.com
• {BLOCKED}bala.com
• {BLOCKED}ohnsbeefjerky.com
• {BLOCKED}opmultimedia.com
• {BLOCKED}.in
• {BLOCKED}ornet.se
• {BLOCKED}mat.biz
• {BLOCKED}orangegames.com
• {BLOCKED}phoenixmedia.com
• {BLOCKED}gaantigal.com
• {BLOCKED}.net
• {BLOCKED}tlehouse.com
• {BLOCKED}taviation.com
• {BLOCKED}india.com
• {BLOCKED}dland.com.au
• {BLOCKED}ad.com
• {BLOCKED}killmedia.com
• {BLOCKED}du.com
• {BLOCKED}oseonline.com
• {BLOCKED}mccall.com
• {BLOCKED}arygreer.org
• {BLOCKED}ep.org
• {BLOCKED}ingdelaplage.com
• {BLOCKED}talcitytuxedo.com
• {BLOCKED}bbean-mercy.org
• {BLOCKED}behair.com
• {BLOCKED}iweb.com
• {BLOCKED}iereurope.be
• {BLOCKED}copias.com.br
• {BLOCKED}imp.com.br
• {BLOCKED}4choice.org
• {BLOCKED}rinting.com.au
• {BLOCKED}i.com
• {BLOCKED}bikalip.com.tr
• {BLOCKED}england.com
• {BLOCKED}lescrail.com
• {BLOCKED}dscope.com
• {BLOCKED}ce-select.com
• {BLOCKED}reative.com
• {BLOCKED}chsupplies.net
• {BLOCKED}rcutautoglass.com
• {BLOCKED}asite.com
• {BLOCKED}pku.edu.cn
• {BLOCKED}th.com
• {BLOCKED}arsia.com
• {BLOCKED}raining.cl
• {BLOCKED}ellodeboveda.com
• {BLOCKED}inentaldental.com
• {BLOCKED}ina.com
• {BLOCKED}c.de
• {BLOCKED}erstonestatebank.com
• {BLOCKED}pinshouse.org
• {BLOCKED}c.org
• {BLOCKED}process.org
• {BLOCKED}om
• {BLOCKED}rcove.com
• {BLOCKED}b.net
• {BLOCKED}orin-kaku.com
• {BLOCKED}nesclub.com
• {BLOCKED}um.org
• {BLOCKED}svill.org
• {BLOCKED}mponents.com
• {BLOCKED}rescueusa.com
• {BLOCKED}nomn.us
• {BLOCKED}vto.ru
• {BLOCKED}arcaregiver.org
• {BLOCKED}clinic.com
• {BLOCKED}ngfa.com
• {BLOCKED}ro.se
• {BLOCKED}rgrafic.com
• {BLOCKED}d.com
• {BLOCKED}medya.com
• {BLOCKED}opyxpress.com
• {BLOCKED}stymining.com
• {BLOCKED}uukyaku.com
• {BLOCKED}penntest.com
• {BLOCKED}gen.com
• {BLOCKED}stds.org
• {BLOCKED}persyst.com
• {BLOCKED}entadesign.co.uk
• {BLOCKED}rdalia.com
• {BLOCKED}n.wx4akq.org
• {BLOCKED}ro-stewards.com
• {BLOCKED}.net
• {BLOCKED}tsupply.com
• {BLOCKED}cles.com
• {BLOCKED}sia.it
• {BLOCKED}roup.com
• {BLOCKED}inn.is
• {BLOCKED}archofamerica.com
• {BLOCKED}withus.net
• {BLOCKED}hercorp.com
• {BLOCKED}chersgifts.com
• {BLOCKED}idadoubled.com
• {BLOCKED}koma.com
• {BLOCKED}er-high.school.nz
• {BLOCKED}erickallergy.com
• {BLOCKED}patentauction.com
• {BLOCKED}uet.com
• {BLOCKED}lt
• {BLOCKED}ielramosehijos.com
• {BLOCKED}.net
• {BLOCKED}lingonlinemagazine.com
• {BLOCKED}cpa.com
• {BLOCKED}ois.com
• {BLOCKED}ap.com
• {BLOCKED}alairservice.com
• {BLOCKED}l-smtp-in.l.google.com
• {BLOCKED}coursemarketing.com
• {BLOCKED}valuecenter.com
• {BLOCKED}ur.com.br
• {BLOCKED}ntrain.coop
• {BLOCKED}nearthholidays.com
• {BLOCKED}nlightpm.com
• {BLOCKED}sautobody.com
• {BLOCKED}multimedia.com
• {BLOCKED}ell.com.au
• {BLOCKED}d.k12.ca.us
• {BLOCKED}omare.nl
• {BLOCKED}enwave.net
• {BLOCKED}outinc.com
• {BLOCKED}ltennis.com
• {BLOCKED}rdjohnson.net
• {BLOCKED}.co.uk
• {BLOCKED}u.com
• {BLOCKED}services.com
• {BLOCKED}india.com
• {BLOCKED}ep.com
• {BLOCKED}-cons.com
• {BLOCKED}ono.net
• {BLOCKED}s.fr
• {BLOCKED}org.pe
• {BLOCKED}strazioni.net
• {BLOCKED}inethatinc.com
• {BLOCKED}smtp.messagingengine.com
• {BLOCKED}a-seikatu.com
• {BLOCKED}aneye.in
• {BLOCKED}atimes.com.didtheyreadit.com
• {BLOCKED}x.ca
• {BLOCKED}lliworks.com.au
• {BLOCKED}lsysco.com
• {BLOCKED}rvantage.com
• {BLOCKED}stint.com
• {BLOCKED}-karnataka.org
• {BLOCKED}h.com
• {BLOCKED}actor.com
• {BLOCKED}kutilities.com
• {BLOCKED}encorp.com
• {BLOCKED}iesfund.org.uk
• {BLOCKED}com.au
• {BLOCKED}usic.nl
• {BLOCKED}connect.co.za
• {BLOCKED}it.com
• {BLOCKED}stocracy.org
• {BLOCKED}chanona.com
• {BLOCKED}oshop.com
• {BLOCKED}nbishopentertainment.com
• {BLOCKED}chigroup.com
• {BLOCKED}.net.pl
• {BLOCKED}shi-hp.com
• {BLOCKED}ker.com
• {BLOCKED}cci.or.jp
• {BLOCKED}telier.com
• {BLOCKED}ariage.com
• {BLOCKED}ershipforum.us
• {BLOCKED}uridica.com
• {BLOCKED}rationyoga.com
• {BLOCKED}orth.com
• {BLOCKED}-online-poker-game.com
• {BLOCKED}erlookz.com
• {BLOCKED}etic.com
• {BLOCKED}kirjat.com
• {BLOCKED}computer.hu
• {BLOCKED}o.co.uk
• {BLOCKED}regor.co.kr
• {BLOCKED}star.com
• {BLOCKED}c3.net
• {BLOCKED}ai.com
• {BLOCKED}.airmail.net
• {BLOCKED}57.us2.mcsv.net
• {BLOCKED}7.digitalwaves.co.nz
• {BLOCKED}chimp.com
• {BLOCKED}gacorp.com
• {BLOCKED}asur.com
• {BLOCKED}attanarts.org
• {BLOCKED}yantralaya.com
• {BLOCKED}usgrimes.co.uk
• {BLOCKED}el.ch
• {BLOCKED}exco.com
• {BLOCKED}inezmoya-abogados.com
• {BLOCKED}echn.com
• {BLOCKED}ergrp-spb.ru
• {BLOCKED}nneyinsurance.com
• {BLOCKED}bemarine.com
• {BLOCKED}22.net
• {BLOCKED}dies.org
• {BLOCKED}estga.com
• {BLOCKED}burns.com
• {BLOCKED}gui.com
• {BLOCKED}inikos.com
• {BLOCKED}lub.ru
• {BLOCKED}car-vacaciones.com
• {BLOCKED}n.com
• {BLOCKED}lp.com
• {BLOCKED}ys.com
• {BLOCKED}mail.ru
• {BLOCKED}eapcoupons.com
• {BLOCKED}lecenter.com
• {BLOCKED}agurus.com
• {BLOCKED}onalwallcovering.com
• {BLOCKED}apictures.com
• {BLOCKED}venementiel.com
• {BLOCKED}pro.com.tw
• {BLOCKED}atrixsolutions.com
• {BLOCKED}paperdrive.com
• {BLOCKED}daysiteng.com
• {BLOCKED}edictionary.com
• {BLOCKED}ary.nazwa.pl
• {BLOCKED}y.com.cn
• {BLOCKED}nredshaw.co.uk
• {BLOCKED}hdakotapreps.com
• {BLOCKED}p.co.jp
• {BLOCKED}as.cz
• {BLOCKED}n-networks.net
• {BLOCKED}ji-school.com
• {BLOCKED}mek.com.tr
• {BLOCKED}tball.be
• {BLOCKED}icialryan.com
• {BLOCKED}u.com
• {BLOCKED}ys-cove.com
• {BLOCKED}uinamusement.com
• {BLOCKED}otype.com
• {BLOCKED}.ba
• {BLOCKED}ame.com
• {BLOCKED}che-valencia.com
• {BLOCKED}.ca
• {BLOCKED}isionorganizing.com
• {BLOCKED}tart-adc.com
• {BLOCKED}pecindustries.com
• {BLOCKED}ak.org
• {BLOCKED}omail.com
• {BLOCKED}nstackwarehouse.com.au
• {BLOCKED}myride.com
• {BLOCKED}.net
• {BLOCKED}cz
• {BLOCKED}akefield.co.uk
• {BLOCKED}soft.ru
• {BLOCKED}propertyservices.us
• {BLOCKED}oneretreat.com
• {BLOCKED}oebius.com
• {BLOCKED}rdhits.com
• {BLOCKED}c.ca
• {BLOCKED}edia.ru
• {BLOCKED}rtconti.com
• {BLOCKED}estercathedral.org
• {BLOCKED}oshow.com.au
• {BLOCKED}inacoiffure.com
• {BLOCKED}s.net
• {BLOCKED}hdavid.com
• {BLOCKED}nacompany.com
• {BLOCKED}ng-japan.com
• {BLOCKED}nto.com
• {BLOCKED}tishpolicecu.co.uk
• {BLOCKED}.ie
• {BLOCKED}tite.com
• {BLOCKED}amu.com
• {BLOCKED}door.pl
• {BLOCKED}ico-ind.com
• {BLOCKED}eyspizza.ph
• {BLOCKED}ltile.com
• {BLOCKED}eliteexpress.com
• {BLOCKED}sales.co.uk
• {BLOCKED}ya.net
• {BLOCKED}.compuserve.com
• {BLOCKED}.directcon.net
• {BLOCKED}.live.com
• {BLOCKED}.mail.yahoo.com
• {BLOCKED}.sbcglobal.yahoo.com
• {BLOCKED}ex.es
• {BLOCKED}ub.com
• {BLOCKED}tioncorp.com
• {BLOCKED}edorganizing.com
• {BLOCKED}z.kharkov.ua
• {BLOCKED}advertising.com
• {BLOCKED}group.com
• {BLOCKED}i.org
• {BLOCKED}cehere.tv
• {BLOCKED}ckaginggroup.com
• {BLOCKED}media.ca
• {BLOCKED}mundsnscc.com
• {BLOCKED}lpennygames.com
• {BLOCKED}net.de
• {BLOCKED}kings-dating.com
• {BLOCKED}-ddos.me
• {BLOCKED}ru.it
• {BLOCKED}rasilrp.com.br
• {BLOCKED}erlandsound.com
• {BLOCKED}tka.com
• {BLOCKED}rtufi.com
• {BLOCKED}hiplan.com
• {BLOCKED}ual.com
• {BLOCKED}ryildirim.net
• {BLOCKED}on.com
• {BLOCKED}ing-video.com
• {BLOCKED}etron.com
• {BLOCKED}ole.com
• {BLOCKED}alab.com.tr
• {BLOCKED}ico.com
• {BLOCKED}decal.com
• {BLOCKED}rtofhair.com
• {BLOCKED}atcave.org.uk
• {BLOCKED}ardenctr.com
• {BLOCKED}asmusforum.com
• {BLOCKED}ergery.com
• {BLOCKED}aterwaystrust.com
• {BLOCKED}asdbrown.com
• {BLOCKED}connect.pl
• {BLOCKED}hacademy.org
• {BLOCKED}learthcare.com.au
• {BLOCKED}enmeuse.com
• {BLOCKED}amura.com
• {BLOCKED}k7.org
• {BLOCKED}ity-works.com
• {BLOCKED}org
• {BLOCKED}-a-round.com
• {BLOCKED}feplanning.com
• {BLOCKED}ele-roysakuma.com
• {BLOCKED}dsu.org
• {BLOCKED}edearthgroup.com
• {BLOCKED}lon89.com
• {BLOCKED}tiaproject.com
• {BLOCKED}hosting.com
• {BLOCKED}uardpkg.com
• {BLOCKED}.com
• {BLOCKED}ipharm.de
• {BLOCKED}oria.com.pl
• {BLOCKED}yakumar.org
• {BLOCKED}aggiosancarlo.it
• {BLOCKED}rma.com
• {BLOCKED}lur.by
• {BLOCKED}.org
• {BLOCKED}towall.se
• {BLOCKED}rproofcharters.com
• {BLOCKED}news.com
• {BLOCKED}hillsstl.org
• {BLOCKED}xecutiveservice.com
• {BLOCKED}rosemarketing.com
• {BLOCKED}nsfieldhockey.com
• {BLOCKED}owerontheweb.com
• {BLOCKED}sure.com
• {BLOCKED}avant-ime.com
• {BLOCKED}bigjohnsbeefjerky.com
• {BLOCKED}childscope.com
• {BLOCKED}chscreative.com
• {BLOCKED}eygwindows.co.uk
• {BLOCKED}hpp-services.com
• {BLOCKED}ixtractor.com
• {BLOCKED}justconnect.co.za
• {BLOCKED}mibsga.com
• {BLOCKED}myfilecenter.com
• {BLOCKED}patentauction.com
• {BLOCKED}rodeoshow.com.au
• {BLOCKED}saios.net
• {BLOCKED}servico-ind.com
• {BLOCKED}solutioncorp.com
• {BLOCKED}teknorhino.com
• {BLOCKED}theartofhair.com
• {BLOCKED}traderush.com
• {BLOCKED}vanguardpkg.com
• {BLOCKED}llcommunications.de
• {BLOCKED}xiao.com
• {BLOCKED}moto-sr.com
• {BLOCKED}oomla.com
• {BLOCKED}o.com
• {BLOCKED}barbatului.ro