BKDR_SIMDA.RS

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It connects to a website to send and receive information.

Arrival Details

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This backdoor drops the following copies of itself into the affected system:

• %Application Data%\ScanDisc.exe
• %Application Data%\{random}.exe
• %User Temp%\{random number}.tmp

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.. %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.)

It drops the following component file(s):

• %Application Data%\{random}.reg
• %Application Data%\mcp.ico
• %Application Data%\Mozilla\Firefox\Profiles\{random}\searchplugins\search.xml
• %Desktop%\Computer.lnk
• %User Temp%\{random}.sys - encrypted
• %User Temp%\{random}-{random}.exe - TSPY_SIMDA.SUS
• %User Temp%\{random number}.tmp - TROJ_SIMDA.SU
• %User Temp%\{random}.exe - TROJ_SIMDA.SUSF

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.. %Desktop% is the current user's desktop, which is usually C:\Documents and Settings\{User Name}\Desktop on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\Desktop on Windows Vista and 7.. %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.)

Autostart Technique

This backdoor adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\RunOnce
{random name} = "%Application Data%\{random}.exe"

Other System Modifications

This backdoor adds the following registry entries:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Policies\
System
EnableLUA = "0"

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows
update = "shortcut"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Policies\
System
ConsentPromptBehaviorUser = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Policies\
System
ConsentPromptBehaviorAdmin = "0"

It modifies the following registry entries:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\Tcpip\Parameters\
Interfaces\{GUID}
NameServer = "8.8.8.8"

(Note: The default value data of the said registry entry is "".)

Backdoor Routine

This backdoor connects to the following websites to send and receive information:

• {BLOCKED}t.aa555s55sk5yw5u.com

Download Routine

This backdoor accesses the following websites to download files:

• http://{BLOCKED}1.highguarded.com/?abbr=RTK&action=download&setupType=drop64&setupFileName=dropper64.exe
• http://{BLOCKED}1.randomstring.com/update_c1eec.exe

Information Theft

This backdoor gathers the following data:

• Computer Name
• Network Adapter
• SusClientId
• Product Id
• Windows Install Date
• Volume Information
• Language Information

Other Details

This backdoor checks for the presence of the following process(es):

• wspass.exe
• wireshark.exe
• windbg.exe
• vba32arkit.exe
• tcpdump.exe
• ollydbg.exe
• observer.exe
• irise.exe
• dumpcap.exe
• cv.exe
• apis32.exe
• ZxSniffer.exe
• WinDump.exe
• VBoxTray.exe
• VBoxService.exe
• Syser.exe
• SymRecv.exe
• Sniffer.exe
• SbieSvc.exe
• SbieCtrl.exe
• SandboxieRpcSs.exe
• SandboxieDcomLaunch.exe
• SUPERAntiSpyware.exe
• Regshot.exe
• PEBrowseDbg.exe
• IrisSvc.exe
• EtherD.exe
• ERUNT.exe
• ERDNT.exe
• DrvLoader.exe
• CamtasiaStudio.exe
• CamRecorder.exe
• Aircrack-ng Gui.exe

It does the following:

• When a number of conditions listed below are met, this backdoor executes in an infinite loop.
  • It checks for the exisitence of the following registry keys:
    • HKEY_CURRENT_USER\Software\CommView
    • HKEY_CURRENT_USER\SYSTEM\CurrentControlSet\Services\IRIS5
    • HKEY_CURRENT_USER\Software\eEye Digital Security
    • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Wireshark
    • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\wireshark.exe
    • HKEY_CURRENT_USER\SOFTWARE\ZxSniffer
    • HKEY_CURRENT_USER\SOFTWARE\Cygwin
    • HKEY_CURRENT_USER\SOFTWARE\Cygwin
    • HKEY_CURRENT_USER\SOFTWARE\B Labs\Bopup Observer
    • HKEY_CURRENT_USER\AppEvents\Schemes\Apps\Bopup Observer
    • HKEY_CURRENT_USER\Software\B Labs\Bopup Observer
    • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Win Sniffer_is1
    • HKEY_CURRENT_USER\Software\Win Sniffer
    • HKEY_CURRENT_USER\SOFTWARE\Classes\PEBrowseDotNETProfiler.DotNETProfiler
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu2\Programs\Debugging Tools for Windows (x86)
    • HKEY_CURRENT_USER\SYSTEM\CurrentControlSet\Services\SDbgMsg
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu2\Programs\APIS32
    • HKEY_CURRENT_USER\Software\Syser Soft
    • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\APIS32
    • HKEY_CURRENT_USER\SOFTWARE\APIS32
    • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Oracle VM VirtualBox Guest Additions
    • HKEY_CURRENT_USER\SYSTEM\CurrentControlSet\Services\VBoxGuest
    • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Sandboxie
    • HKEY_CURRENT_USER\SYSTEM\CurrentControlSet\Services\SbieDrv
    • HKEY_CURRENT_USER\Software\Classes\Folder\shell\sandbox
    • HKEY_CURRENT_USER\Software\Classes\*\shell\sandbox
    • HKEY_CURRENT_USER\SOFTWARE\SUPERAntiSpyware.com
    • HKEY_CURRENT_USER\SOFTWARE\Classes\SUPERAntiSpywareContextMenuExt.SASCon.1
    • HKEY_CURRENT_USER\SOFTWARE\SUPERAntiSpyware.com
    • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ERUNT_is1
  • It also checks for loaded libraries:
    • SBIEDLL.DLL
    • SBIEDLLX.DLL
    • DBGHELP.DLL
  • It also checks if the following information are equal:
    • Computer Name = Sandbox
    • User name = CurrentUser
    • File name = file.exe
• It attempts to open the file %System Root%\cgvi5r6i\vgdgfd.72g, which may contain shell commands.
• It appends the legitimate file %User Profile%\Application Data\Mozilla\Firefox\Profiles\{random}\prefs.js with user_pref(&"browser.search.selectedEngine&"http://{BLOCKED}la.com/?&uid={number}&q={searchTerms}");