BKDR_SATHUR.A

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes commands from a remote malicious user, effectively compromising the affected system.

It terminates itself if it detects it is being run in a virtual environment.

Arrival Details

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This backdoor drops the following component file(s):

• {Malware Path}\SecurityHelper.dll {detected as BKDR_SATHUR.A}

It injects itself into the following processes running in the affected system's memory:

• explorer.exe
• rundll32.exe
• regsvr32.exe

It creates the following folders:

• {Malware Path}\temp
• {Malware Path}\SecurityCache\
• {Malware Path}\SecurityCache\cache
• {Malware Path}\SecurityCache\data

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• Global\{982C49E7-2232-4B26-B379-309AFAB28096}

Other System Modifications

This backdoor adds the following registry keys:

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{3B5B973C-92A4-4855-9D3F-0F3D23332208}\InprocServer

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\
ShellIconOverlayIdentifiers\0PerformanceMonitor

It adds the following registry entries as part of its installation routine:

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{3B5B973C-92A4-4855-9D3F-0F3D23332208}
(Default) = "Windows Performance Monitor"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{3B5B973C-92A4-4855-9D3F-0F3D23332208}\InprocServer32
(Default) = "%All Users Profile%\Application Data\Application Data\Microsoft\Performance\Monitor\PerformanceMonitor.dll"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\
ShellIconOverlayIdentifiers\0PerformanceMonitor
(Default) = "{3B5B973C-92A4-4855-9D3F-0F3D23332208}"

Backdoor Routine

This backdoor executes the following commands from a remote malicious user:

• Get system information
• Update the copy of the trojan
• Run arbitrary files

It connects to the following URL(s) to send and receive commands from a remote malicious user:

• {BLOCKED}i8asdaskjdkn.in

Other Details

This backdoor terminates itself if it detects it is being run in a virtual environment.

NOTES:

This backdoor checks for the following as part of its anti-sandbox and anti-virtual machine routines:

• Existence of the following windows:
  • SandboxieControlWndClass (sandboxie)
  • Afx:400000:0 (Winjail Sandbox)
• Running process path contains:
  • sample (Anubis sandbox)
  • file.exe (sunbelt sandbox)
• Username is:
  • andy (Anubis sandbox)
  • vmdg
  • currentuser (Norman Sandbox)
  • schmidti (CW sandbox)
• Existence of the following VMWare-related files:
  • vmupgradehelper.exe
  • vmwareuser.exe
  • vmwaretray.exe
  • vmtoolsd.exe
  • vmtoolsd.exe
• Existence of the following VBox related files:
  • vboxservice.exe
  • vboxtray.exe