BKDR_STONEDRILL.A

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes commands from a remote malicious user, effectively compromising the affected system. It connects to a website to send and receive information.

Arrival Details

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This backdoor drops the following copies of itself into the affected system:

• %User Temp%\bd891.tmp
• %ProgramData%\Chrome\{random filename}.exe
• %ProgramData%\InternetExplorer\{random filename}Stp.exe

(Note: %User Temp% is the user's temporary folder, where it usually is C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local\Temp on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.. %ProgramData% is the Program Data folder, where it usually is C:\Program Files in Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\ProgramData in Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

It drops the following files:

• %ProgramData%\Chrome\FileInfo.txt
• %ProgramData%\InternetExplorer\FileInfoStp.txt
• %User Temp%\C-Dlt-C-Trsh-T.tmp
• %User Temp%\C-PDC-C-Cpy-T.vbs ← used to copy itself
• %User Temp%\C-PDI-C-Cpy-T.vbs ← used to copy itself
• %User Temp%\C-Dlt-C-Org-T.vbs ← used to delete initial copy
• %User Temp%\C-Strt-C-Up-T.vbs ← used to create autorun registry

(Note: %ProgramData% is the Program Data folder, where it usually is C:\Program Files in Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\ProgramData in Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.. %User Temp% is the user's temporary folder, where it usually is C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local\Temp on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

It injects codes into the following process(es):

• User's default browser (except LaunchWinApp.exe)

Autostart Technique

This backdoor adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
{random file name} = "%ProgramData%\InternetExplorer\{random file name}Stp.exe"

Backdoor Routine

This backdoor executes the following commands from a remote malicious user:

• Uninstall self
• Get system information (OS version, Architecture, Build, Environment)
• Get system time
• Get malware version
• Remote command shell
• Screen capture
• Download files
• Upload files
• Check antivirus installation and registries (McAfee, AVG, Avast, Bitdefender)

It connects to the following websites to send and receive information:

• http://www.{BLOCKED}ervic.com/

Other Details

This backdoor does the following:

• It is capable of wiping (deleting) files on the following locations:
  • All accessible physical drives by using the device path '\.\PhysicalDrive'.
  • All accessible logical drives by using device path '\.\X:'.
  • All folders except 'Windows' on all accessible drives.
  • Files named 'asdhgasdasdwqe%digits%' in the root folder of the disk.
• It generates the "{random file name}.exe" by choosing random strings from the sets of strings as follows:
  %ProgramData%\{set 1}{set 2}{set 3}.exe
  • SET 1
    • AMD
    • Adobe
    • Application
    • Bitlocker
    • Browser
    • CDROM
    • CPU
    • Cash
    • Cisco
    • Cloud
    • Desktop
    • Display
    • DotNet
    • Ethernet
    • Fingerprint
    • Intel
    • Java
    • Location
    • Lockscreen
    • MFC
    • Map
    • Memory
    • Microsoft
    • Monitor
    • NFC
    • Office
    • Packet
    • Power
    • Query
    • RAM
    • ROM
    • Registery
    • Run-time
    • SQL
    • SunGard
    • Task
    • WMI
    • Windows
  • SET 2
    • Agent
    • Core
    • Data
    • Device
    • Engine
    • File
    • Firewall
    • Gaming
    • Graphic
    • Hardware
    • History
    • Media
    • Network
    • Performance
    • Server
    • Service
    • Software
    • Storage
    • System
    • VM
    • Wizard
    • boot
  • SET 3
    • API
    • APP
    • Adapter
    • Arranger
    • Backup
    • CleanUp
    • Client
    • Controller
    • Details
    • Diagnostics
    • Encryption
    • Events
    • Execute
    • Extention
    • Framework
    • Help
    • Host
    • LogOn
    • Luncher
    • Manager
    • Menu
    • Model
    • Plug
    • Policy
    • Provider
    • Proxy
    • Recovery
    • Stub
    • Tester
    • Transfer

(Note: %ProgramData% is the Program Data folder, where it usually is C:\Program Files in Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\ProgramData in Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)