BKDR_CRIDEX.MR

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes commands from a remote malicious user, effectively compromising the affected system.

It deletes the initially executed copy of itself.

Arrival Details

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This backdoor drops the following copies of itself into the affected system and executes them:

• %Application Data%\KB{random number}.exe

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.)

It creates the following folders:

• %Application Data%\{random folder name}

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.)

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• Local\XME{8 random characters}
• Local\XMI{8 random characters}
• Local\XMM{8 random characters}
• Local\XMS{8 random characters}
• Local\XMF{8 random characters}
• Local\XMR{8 random characters}
• Local\XMQ{8 random characters}
• Local\XMB{8 random characters}

It injects codes into the following process(es):

• explorer.exe

Autostart Technique

This backdoor adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
KB{random number}.exe = "%Application Data%\KB{random number}.exe"

Other System Modifications

This backdoor adds the following registry keys:

HKEY_CURRENT_USER\Software\Microsoft\
Windows NT\C{random value}

HKEY_CURRENT_USER\Software\Microsoft\
Windows NT\S{random value}

It adds the following registry entries:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings
GlobalUserOffline = "0"

HKEY_CURRENT_USER\Software\Microsoft\
Windows NT\S{random value}
Default = "{script containing bank-related strings}"

Backdoor Routine

This backdoor executes the following commands from a remote malicious user:

• Monitor browser cookies
• Download and execute arbitrary files
• Upload stolen information
• Download configuration files

It connects to the following URL(s) to send and receive commands from a remote malicious user:

• http://{BLOCKED}.234.53:8080/LvI/xCA/GoZZkCAAAA/Noy6SAAAA/
• http://{BLOCKED}.190.170:8080/LvI/xCA/GoZZkCAAAA/Noy6SAAAA/
• http://{BLOCKED}.5.195:8080/LvI/xCA/GoZZkCAAAA/Noy6SAAAA/
• http://{BLOCKED}.74.5:8080/LvI/xCA/GoZZkCAAAA/Noy6SAAAA/
• http://{BLOCKED}.3.246:8080/LvI/xCA/GoZZkCAAAA/Noy6SAAAA/
• http://{BLOCKED}.138.172:8080/LvI/xCA/GoZZkCAAAA/Noy6SAAAA/
• http://{BLOCKED}.224.130:8080/LvI/xCA/GoZZkCAAAA/Noy6SAAAA/
• http://{BLOCKED}.246.151:8080/LvI/xCA/GoZZkCAAAA/Noy6SAAAA/
• http://{BLOCKED}.148.92:8080/LvI/xCA/GoZZkCAAAA/Noy6SAAAA/
• http://{BLOCKED}.242.8:8080/LvI/xCA/GoZZkCAAAA/Noy6SAAAA/
• http://{BLOCKED}.130.98:8080/LvI/xCA/GoZZkCAAAA/Noy6SAAAA/
• http://{BLOCKED}.6.95:8080/LvI/xCA/GoZZkCAAAA/Noy6SAAAA/
• http://{BLOCKED}.184.3:8080/LvI/xCA/GoZZkCAAAA/Noy6SAAAA/
• http://{BLOCKED}.156.20:8080/LvI/xCA/GoZZkCAAAA/Noy6SAAAA/
• http://{BLOCKED}.22.14:8080/LvI/xCA/GoZZkCAAAA/Noy6SAAAA/
• http://{BLOCKED}.148.213:8080/LvI/xCA/GoZZkCAAAA/Noy6SAAAA/
• http://{BLOCKED}.30.185:8080/LvI/xCA/GoZZkCAAAA/Noy6SAAAA/
• http://{BLOCKED}.189.229:8080/LvI/xCA/GoZZkCAAAA/Noy6SAAAA/
• http://{BLOCKED}.201.180:8080/LvI/xCA/GoZZkCAAAA/Noy6SAAAA/
• http://{BLOCKED}.80.40:8080/LvI/xCA/GoZZkCAAAA/Noy6SAAAA/
• http://{BLOCKED}.143.90:8080/LvI/xCA/GoZZkCAAAA/Noy6SAAAA/
• http://{BLOCKED}.36.93:8080/LvI/xCA/GoZZkCAAAA/Noy6SAAAA/
• http://{BLOCKED}.167.124:8080/LvI/xCA/GoZZkCAAAA/Noy6SAAAA/
• http://{BLOCKED}.90.92:8080/LvI/xCA/GoZZkCAAAA/Noy6SAAAA/

Other Details

This backdoor deletes the initially executed copy of itself

NOTES:

This backdoor monitors browser activities of the affected system, specifically the address bar or title bar, using the following strings:

• /ach/
• /authentication/zbf/k/
• /bb/logon/
• /cashman/
• /cashplus/
• /clkccm/
• /cmmain\.cfm
• /cmserver/
• /cmwire
• /ebc_ebc1961/
• /ibs\.
• /ibws/
• /icm/
• /icm2/
• /inets/
• /livewire/
• /loginolb/loginolb
• /netbnx/
• /olbb/
• /phcp
• /sbuser/
• /smallbiz/
• /wcmpw/
• /webcm/
• /wire/
• /wires/
• 2checkout\.com
• \.com/k1/
• ablv\.com
• abnamro\.nl
• access\.jpmorgan\.com
• access\.usbank\.com
• accessbankplc\.com
• accountoverview\.aspx
• accurint\.com
• accurint\.com
• achieveaccess\.citizensbank\.com
• achpayment
• achredirect\.aspx
• achweb\.unionbank\.com
• achworks\.com
• alltimetreasury\.pacificcapitalbank\.com
• alphabank\.com
• amegybank\.com/
• anb\.portalvault\.com
• anz\.com
• atbonlinebusiness\.com
• auth\.umb\.com
• authmaster\.nationalcity\.com
• baltikums\.eu
• baltikums\.com
• banesco\.com\.pa
• bankbyweb
• bankfirst\.com
• banking\.firsttennessee\.biz
• banking\.calbanktrust\.com
• banknet\.lv
• bankofamerica\.com
• bankofbermuda\.com
• bankofcyprus\.com
• bankonline\.umpquabank\.com
• bankonline\.sboff\.com
• bbo\.1stsource\.com
• bib\.lv
• billauth
• billmenu
• bizcurrency\.com
• blilk
• bmo\.com/
• bmoharrisprivatebankingonline\.com
• bmomutualfunds\.com
• bnycash\.bankofny\.com
• bob\-w\.
• bob\.sovereignbank\.com
• bolb\-east\.associatedbank\.com
• bolb\-west\.associatedbank\.com
• bolb\.
• boveda\.banamex\.com\.mx
• bscincky\.com
• business\.swedbank\.lv
• business\.macu\.com
• business\.netbankerplus\.com
• business_solutions
• businessaccess\.citibank\.citigroup\.com
• businessappshome
• businessbanking\.cibc\.com
• businessclassonline\.compassbank\.com
• businesslogin
• businessmanager\.com
• businessonline
• businessportal\.mibank\.com
• butterfieldonline\.ky
• bxs\.com
• cashanalyzer\.com
• cashmanager\.mizuhoe\-treasurer\.com
• cashmgmt
• cashmgt
• cashproonline\.bankofamerica\.com
• cashproweb\.com/cpwportal
• cbbusinessonline\.com
• cbonline
• cencorpcu\.com
• cencorpcu\.com/
• cfgbusinessaccess\.com
• checkgateway
• checkout\.com/va/login
• cib\.bankofthewest
• cibconline\.cibc\.com
• cimbanque\.net
• citizensbankmoneymanagergps\.com
• cmachm\.w
• cmbmnt\.w
• cmol\.bbt\.com/auth
• cmwirp\.w
• cnbsec1\.
• colb\.
• comerica\.com
• commercebusinessdirect\.com
• commercial\.wachovia\.com
• commercialservices
• connect\.colonialbank\.com
• connect\.bankcolonial\.com
• constitutioncorp\.org
• corpach
• corporate\.epfc\.com
• corporateconnect\.net
• corporatebankingweb
• corporateaccounts
• corpower\.coop
• createcorpwire
• createwire
• cu\.com
• cu\.org
• danskebanka\.lv
• db\-direct\.db\.com
• directline4biz\.com
• directnet\.com
• directnet\.com
• e\-moneyger
• e\-norvik\.lv
• easywebcpo\.td\.com/waw/idp
• ebanking-ch2\.ubs\.com
• ebanking\-services
• ebemo\.bemobank\.com
• ebill\.highmark\.com
• ecash\.
• ecm\-transfers\.unionbank\.com
• ecms\.unionbank\.com
• efirstbank\.com
• ekp\.lv
• enternetbank\.com
• enterprise2\.openbank\.com
• epd\.uscentral\.org
• eurobankefg\.com
• exact4web
• exness\.com
• express\.53\.com
• expressdeposit\.colonialbank\.com
• fbmedirect\.com
• ffinonline\.com
• ffrontier\.com
• firstbancorp\.com
• firstbanks\.com
• firstcitizens\.com
• fnfgbusinessonline\.enterprisebanker\.com
• fxpayments\.americanexpress\.com
• geonline\.lv
• global1\.onlinebank\.com
• global\-ebanking\.com
• globalink\.leumiusa\.com
• goldleaf
• guard\.scotiabank\.com
• handelsbanken\.lv
• hbcash\.exe
• hblibank\.com
• hbproxy\.exe
• hellenicnetbanking\.com
• hillsbank\.com
• hiponet\.lv
• hkbea
• hsbc\.com\.mx
• i\-linija\.lt
• ib\.dnb\.lv
• ibanking\-services\.com
• ibbpl2\.com
• ibbpowerlink\.com
• ibbusinessnet\.com
• ibcbankonline\.ibc\.com
• ifxmanager\.bnymellon\.com
• ifxmanager\.bankofny\.com
• inetbanker
• ing\.nl
• injectreceiver
• internationalbanking\.
• internationalpayments\.
• internet\-ebanking\.com
• internetbanker\.cc
• itinternet\.net
• itreasury\.amsouth\.com
• ktt\.key\.com
• lakelandbank\.com
• libertymutualbusinessdirect\.com
• lionbank\.com
• login_business\.asp
• logincm
• loyalbank\.com
• lv\.unicreditbanking\.net
• marfinbank\.com\.cy
• mbachexpress\.com
• mcb\-home\.com/online
• memberach
• metrobankdirect\.com
• midatlanticcorp\.org
• moneymanagergps\.com
• multinetbank\.eu
• my\.statestreet\.com
• mycorporate\.org
• myonline\.bankbv\.com
• myonlineservices\.cbolobank\.com
• nab\.com\.au
• nashvillecitizensbank\.com
• nationalcity\.com/consultnc
• nbad\.com
• nbarizona\.com/login_business\.jsp
• nbb\.controlsecure\.com
• ncms\-inc\.com
• netteller
• nfbconnect\.com
• northbaybancorp\.com
• northerntrust\.com
• norvik\.lv
• nsbank\.com
• ntrs\.com
• nubi
• olb\.
• olb\.ent\.com/business/
• online\-offshore\.lloydstsb\.com
• online\.1stnb\.com
• plainscapital\.gfxwebwire\.com
• postfinance\.ch
• rabobank\.nl
• rbsm\.com
• secure\.accesshorizon\.com
• snsbank\.nl
• sterlingpayment\.com

It monitors the following browsers:

• chrome.exe
• firefox.exe