BKDR_ANDROM.MA

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes commands from a remote malicious user, effectively compromising the affected system.

It executes the dropped file(s). As a result, malicious routines of the dropped files are exhibited on the affected system.

Arrival Details

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This backdoor drops the following copies of itself into the affected system:

• %All Users Profile%\{random file name}.exe

(Note: %All Users Profile% is the All Users or Common profile folder, which is C:\Documents and Settings\All Users in Windows 2000, XP, and Server 2003, and C:\ProgramData in Windows Vista and 7.)

It adds the following processes:

• svchost.exe
• msiexec.exe

It injects codes into the following process(es):

• svchost.exe
• msiexec.exe

Autostart Technique

This backdoor adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\policies\
Explorer\Run
{random number} = "%All Users Profile%\{random file name}.exe"

Other System Modifications

This backdoor adds the following registry entries:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\AuthorizedApplications\
List
%System%\msiexec.exe = "%System%\msiexec.exe:*:Generic Host Process"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\AuthorizedApplications\
List
%System%\svchost.exe = "%System%\svchost.exe:*:Generic Host Process"

Backdoor Routine

This backdoor executes the following commands from a remote malicious user:

• Download and execute arbitrary files
• Uninstall itself
• Perform remote shell

It connects to the following URL(s) to send and receive commands from a remote malicious user:

• http://{BLOCKED}lse.com/login.php
• http://{BLOCKED}o.su/alter.php
• http://{BLOCKED}c.su/billing.php
• http://{BLOCKED}es.net/filling.php

Dropping Routine

This backdoor drops the following files:

• %User Temp%\{random numbers}.exe - TSPY_ZBOT.MA

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.)

It executes the dropped file(s). As a result, malicious routines of the dropped files are exhibited on the affected system.