BKDR_ZACESS.SMQQ

This backdoor terminates processes which can compromise system security. It also patches a file that subsequently becomes malicious.

This backdoor arrives via peer-to-peer (P2P) shares. It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. It may be dropped by other malware.

It connects to a website to send and receive information.

Arrival Details

This backdoor arrives via peer-to-peer (P2P) shares.

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It may be dropped by the following malware:

• BKDR_ZACCESS.KP

Autostart Technique

This backdoor adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}\
InprocServer32
ThreadingModel = "Both"

HKEY_CURRENT_USER\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}\
InprocServer32
(Default) = "%Application Data%\{GUID}\n."

Other System Modifications

This backdoor modifies the following registry entries:

HKEY_CLASSES_ROOT\CLSID\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\
InprocServer32
(Default) = "\.\globalroot\systemroot\Installer\{GUID}\n."

(Note: The default value data of the said registry entry is %System%\wbem\wbemess.dll.)

Backdoor Routine

This backdoor connects to the following websites to send and receive information:

• http://{BLOCKED}s.{BLOCKED}g.com

Process Termination

This backdoor terminates the following processes if found running in the affected system's memory:

• MsMpSvc
• windefend
• SharedAccess
• iphlpsvc
• wscsvc
• mpssvc
• bfe
• SecurityCenter
• Wscnotify.exe
• MSASCui.exe
• MpCmdRun.exe
• MisSrv.exe
• msseces.exe
• wsctfy.exe

Other Details

This backdoor requires the existence of the following files to properly run:

• %User Temp%\InstallFlashPlayer.exe

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003.)

NOTES:

It connects to its C&C server using UDP connection.

It is a .DLL file, which is executed by %User Temp%\InstallFlashPlayer.exe.

It patches %System%\services.exe and saves the original copy in %System%\Winsxs\Backup\services.exe.

• Patched 64-bit %System%\services.exe - detected as PTCH64_ZACCESS.A
• Patched Win7 32-bit %System%\services.exe - detected as PTCH_ZACCESS.A

The modified registry ensures that the malware is loaded instead of %System%\wbem\wbemess.dll, which is related to Web Browser Control.

The following files, which are dropped by the main malware BKDR_ZACCESS.KP, are used by BKDR_ZACESS.SMQQ in registry entries to enable automatic execution of the malware at every system startup:

• %Application Data%\{GUID}\n.
• \.\globalroot\systemroot\Installer\{GUID}\n.

where \.\globalroot\systemroot is equivalent to %Windows%