BKDR_NETWIRED.C

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes commands from a remote malicious user, effectively compromising the affected system.

Arrival Details

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This backdoor drops the following copies of itself into the affected system and executes them:

• %Application Data%\Install\Host.exe

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.)

It drops and executes the following files:

• %User Temp%\out.exe - detected as TSPY_FAREIT.ADB

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.)

Autostart Technique

This backdoor adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Updater = "%Application Data%\Install\Host.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Active Setup\Installed Components\{20M54OQO-7WAE-6LH8-3328-R4PN1NQ25F4Q}
StubPath = "%Application Data%\Install\Host.exe"

Backdoor Routine

This backdoor executes the following commands from a remote malicious user:

• Download & execute files on the affected system
• Execute Command Shell
• List files on a directory
• Terminate Processes
• Retrieve stored login credentials from browser
• Steal stored Pidgin Accounts
• Perform keylogging routine

It connects to the following URL(s) to send and receive commands from a remote malicious user:

• {BLOCKED}b.{BLOCKED}p.org:7575

Dropping Routine

This backdoor drops the following file(s), which it uses for its keylogging routine:

• %Application Data%\Logs\{Month-Day-Year}

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.)

NOTES:

It attempts to get stored information such as user names, passwords, and hostnames from the following applications:

• Mozilla Firefox
• Mozilla Thunderbird
• Mozilla Seamonkey
• Opera Browser
• Internet Explorer
• Google Chrome