BKDR_POISON.SMJ

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It does not have any propagation routine.

It opens a hidden Internet Explorer window. It executes commands from a remote malicious user, effectively compromising the affected system.

It does not drop any other file.

It does not have any downloading capability.

It does not have any information-stealing capability.

Arrival Details

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This backdoor adds the following mutexes to ensure that only one of its copies runs at any one time:

• fd5gh55a5

It injects threads into the following normal process(es):

• iexplorer.exe

Autostart Technique

This backdoor adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Run
Microsoft netstatupdate = "{malware path and file name}"

Propagation

This backdoor does not have any propagation routine.

Backdoor Routine

This backdoor opens a hidden Internet Explorer window.

It executes the following commands from a remote malicious user:

• Capture screen, audio, and webcam
• Execute binary instructions
• Log keystrokes
• List active ports
• Manage open windows
• Manage passwords
• Manage registry, processes, services, devices, and installed applications
• Perform multiple simultaneous transfers
• Perform remote shell
• Relay server
• Search files
• Share servers
• Update, restart, or terminate itself

It connects to the following URL(s) to send and receive commands from a remote malicious user:

• {BLOCKED}0719.6600.org:443

Dropping Routine

This backdoor does not drop any other file.

Download Routine

This backdoor does not have any downloading capability.

Information Theft

This backdoor does not have any information-stealing capability.

Other Details

This backdoor connects to the following URL(s) to check for an Internet connection:

• go.microsoft.com/fwlink/?LinkId={number}

NOTES:

This backdoor does not have rootkit capabilities.

This backdoor does not exploit any vulnerability.