BKDR_PRORAT.SMA

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It opens a random port to allow a remote user to connect to the affected system. Once a successful connection is established, the remote user executes commands on the affected system. It executes commands from a remote malicious user, effectively compromising the affected system.

Arrival Details

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This backdoor drops the following copies of itself into the affected system:

• %Windows%\services.exe
• %Windows%\system\sservice.exe
• %System%\fservice.exe

(Note: %Windows% is the Windows folder, which is usually C:\Windows.. %System% is the Windows system folder, which is usually C:\Windows\System32.)

Autostart Technique

This backdoor adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}
StubPath = "%System%\sservice.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\policies\
Explorer\Run
DirectX For Microsoft® Windows = "%System%\fservice.exe"

It modifies the following registry entries to ensure it automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Winlogon
Shell = "Explorer.exe %System%\fservice.exe"

(Note: The default value data of the said registry entry is Explorer.exe.)

Other System Modifications

This backdoor deletes the following files:

• %System%\Restore\MachineGuid.txt

(Note: %System% is the Windows system folder, which is usually C:\Windows\System32.)

It adds the following registry entries as part of its installation routine:

HKEY_CURRENT_USER\Software\Microsoft\
Windows NT Script Host\Microsoft DxDiag\WinSettings
Bulas = "1"

HKEY_CURRENT_USER\Software\Microsoft\
Windows NT Script Host\Microsoft DxDiag\WinSettings
FW_KILL = "1"

HKEY_CURRENT_USER\Software\Microsoft\
Windows NT Script Host\Microsoft DxDiag\WinSettings
XP_FW_Disable = "1"

HKEY_CURRENT_USER\Software\Microsoft\
Windows NT Script Host\Microsoft DxDiag\WinSettings
XP_SYS_Recovery = "1"

HKEY_CURRENT_USER\Software\Microsoft\
Windows NT Script Host\Microsoft DxDiag\WinSettings
ICQ_UIN = "xnt/on,hq/bnl"

HKEY_CURRENT_USER\Software\Microsoft\
Windows NT Script Host\Microsoft DxDiag\WinSettings
ICQ_UIN2 = "046007686"

HKEY_CURRENT_USER\Software\Microsoft\
Windows NT Script Host\Microsoft DxDiag\WinSettings
Kurban_Ismi = "whbuhl"

HKEY_CURRENT_USER\Software\Microsoft\
Windows NT Script Host\Microsoft DxDiag\WinSettings
Mail = "exeukrsk034Ao`wds/bnl"

HKEY_CURRENT_USER\Software\Microsoft\
Windows NT Script Host\Microsoft DxDiag\WinSettings
Online_List = "iuuq;..vvv/xntsrhud/bnl.bfh,cho.qsns`u/bfh"

HKEY_CURRENT_USER\Software\Microsoft\
Windows NT Script Host\Microsoft DxDiag\WinSettings
Port = "4001"

HKEY_CURRENT_USER\Software\Microsoft\
Windows NT Script Host\Microsoft DxDiag\WinSettings
Sifre = "032547"

HKEY_CURRENT_USER\Software\Microsoft\
Windows NT Script Host\Microsoft DxDiag\WinSettings
Hata = ""

HKEY_CURRENT_USER\Software\Microsoft\
Windows NT Script Host\Microsoft DxDiag\WinSettings
KSil = "1"

HKEY_CURRENT_USER\Software\Microsoft\
Windows NT Script Host\Microsoft DxDiag\WinSettings
LanNotifie = ""

HKEY_CURRENT_USER\Software\Microsoft\
Windows NT Script Host\Microsoft DxDiag\WinSettings
Tport = "0"

HKEY_CURRENT_USER\Software\Microsoft\
Windows NT Script Host\Microsoft DxDiag\WinSettings
ServerVersionIn = "19"

It adds the following registry keys as part of its installation routine:

HKEY_CURRENT_USER\Software\Microsoft\
Windows NT Script Host

HKEY_CURRENT_USER\Software\Microsoft\
Windows NT Script Host\Microsoft DxDiag

HKEY_CURRENT_USER\Software\Microsoft\
Windows NT Script Host\Microsoft DxDiag\WinSettings

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}

It modifies the following registry entries:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\SystemRestore
DisableSR = "1"

(Note: The default value data of the said registry entry is 0.)

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\sr\Parameters
FirstRun = "1"

(Note: The default value data of the said registry entry is 0.)

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\srservice
Start = "4"

(Note: The default value data of the said registry entry is 2.)

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\sr
Start = "4"

(Note: The default value data of the said registry entry is 0.)

Backdoor Routine

This backdoor opens a random port to allow a remote user to connect to the affected system. Once a successful connection is established, the remote user executes commands on the affected system.

It executes the following commands from a remote malicious user:

• Modify Internet Explorer's homepage
• Open and close CD tray
• Format C:\ and D:\ drive
• Shutdown the system
• Retrieves the following data from the system:
• - Computer name
• - Username
• - Windows Version
• - Windows Language
• - %Windows% Folder Path
• - %System% Folder Path
• - %User Temp% Folder Path
• - Internet Explorer Version
• - Processor Name
• - CPU Speed
• Monitors usernames and passwords in the following messaging applications:
• - ICQ
• - MSN Messenger
• - Yahoo!\Messenger
• - Outlook Express
• - NetMeeting
• Start or stop services
• Create, open, close, or delete files
• Obtain email addresses by accessing the following:
• - Outlook Adress Book
• - Messenger Adress Book
• - Trillian Adress Book
• Monitors visited sites

(Note: %Windows% is the Windows folder, which is usually C:\Windows.. %System% is the Windows system folder, which is usually C:\Windows\System32.. %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.)

It connects to the following URL(s) to send and receive commands from a remote malicious user:

• {BLOCKED}.23.201
• {BLOCKED}.tr
• {BLOCKED}.edu.tr
• {BLOCKED}.edu.tr
• {BLOCKED}.tr

Dropping Routine

This backdoor drops the following files:

• %System%\winkey.dll - detected as BKDR_PRORAT.BL
• %System%\reginv.dl - ldetected as BKDR_PRORAT.BL
• %Windows%\ktd32.atm - contains title name of open windows

(Note: %System% is the Windows system folder, which is usually C:\Windows\System32.. %Windows% is the Windows folder, which is usually C:\Windows.)