BKDR_DEXTR.D

This backdoor may be unknowingly downloaded by a user while visiting malicious websites.

It executes commands from a remote malicious user, effectively compromising the affected system. It connects to a website to send and receive information.

It modifies the Internet Explorer Zone Settings.

It logs a user's keystrokes to steal information.

It deletes the initially executed copy of itself.

Arrival Details

This backdoor may be unknowingly downloaded by a user while visiting malicious websites.

Installation

This backdoor drops the following file(s)/component(s):

• %Application Data%\Java Security Plugin\SecureDll.dll - keylogger module also detected as BKDR_DEXTR.D

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.)

It drops the following copies of itself into the affected system:

• %Application Data%\Java Security Plugin\javaplugin.exe

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.)

It creates the following folders:

• %Application Data%\Java Security Plugin

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.)

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• Windows_Stability_Mutex_1

Autostart Technique

This backdoor adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Sun Java Security Plugin = "%Application Data%\Java Security Plugin\javaplugin.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Sun Java Security Plugin = "%Application Data%\Java Security Plugin\javaplugin.exe"

HKEY_USERS\.DEFAULT\SOFTWARE\
Microsoft\Windows\CurrentVersion\
Run
Sun Java Security Plugin = "%Application Data%\Java Security Plugin\javaplugin.exe"

It drops the following files:

• %Application Data%\Java Security Plugin\strokes.logyrgh
• %Application Data%\Java Security Plugin\strokes.logasdq

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.)

Other System Modifications

This backdoor adds the following registry keys:

HKEY_CURRENT_USER\Software\HelperSolutions Software

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
Associations

It adds the following registry entries:

HKEY_CURRENT_USER\Software\HelperSolutions Software
digit = "{GUID}"

HKEY_CURRENT_USER\Software\HelperSolutions Software
val1 = "%Application Data%\Java Security Plugin\t"

HKEY_CURRENT_USER\Software\HelperSolutions Software
val2 = "%Application Data%\Java Security Plugin\t"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
Associations
LowRiskFileTypes = ".exe;.bat;.reg;.vbs;"

Backdoor Routine

This backdoor executes the following commands from a remote malicious user:

• Update (update copy)
• Checkin (set the delay it sends information)
• Scanin (set the delay it checks memory for information)
• Uninstall (uninstall itself)
• Download (download and execute a file)

It connects to the following websites to send and receive information:

• {BLOCKED}.{BLOCKED}.14.69/a/gateway.php

Web Browser Home Page and Search Page Modification

This backdoor modifies the Internet Explorer Zone Settings.

Information Theft

This backdoor gathers the following data:

• {GUID}
• Username
• Hostname
• Operating System
• Processor type
• List of running processes
• Key to decrypt sent information

It logs a user's keystrokes to steal information.

Other Details

This backdoor deletes the initially executed copy of itself

NOTES:

This backdoor dumps the affected system's memory to check for sensitive information, such as payment details and/or credit card information stored in the aforementioned system.