BKDR_SIMBOT.SMXB

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It connects to certain websites to send and receive information. It deletes the initially executed copy of itself.

Arrival Details

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This backdoor drops the following copies of itself into the affected system:

• %User Profile%\Local Settings\{random service name}.exe

(Note: %User Profile% is the current user's profile folder, which is usually C:\Windows\Profiles\{user name} on Windows 98 and ME, C:\WINNT\Profiles\{user name} on Windows NT, and C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003.)

It adds the following processes:

• svchost.exe

Autostart Technique

This backdoor adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
{random service name} = "%User Profile%\Local Settings\{random service name}.exe"

Other Details

This backdoor connects to the following website to send and receive information:

• http://{BLOCKED}.{BLOCKED}.222.6:80/{five random letters}.php?id={18 random characters}
• http://{BLOCKED}.{BLOCKED}.222.6:443/{five random letters}.php?id={18 random characters}
• http://{BLOCKED}ebook.345.pl:80/{five random letters}.php?id={18 random characters}
• http://{BLOCKED}ebook.345.pl:443/{five random letters}.php?id={18 random characters}

It deletes the initially executed copy of itself

NOTES:

It injects codes into its created process SVCHOST.EXE. It enumerates the services in the affected system and uses a random name from the said list for its dropped copy. It may perform the following:

• Download and save files in %User Temp%
• Execute downloaded files