BKDR_SIMBOT.EOT

This backdoor may be downloaded by other malware/grayware/spyware from remote sites. It may be dropped by other malware.

It executes the dropped file(s). As a result, malicious routines of the dropped files are exhibited on the affected system.

As of this writing, the said sites are inaccessible.

Arrival Details

This backdoor may be downloaded by other malware/grayware/spyware from remote sites.

It may be dropped by the following malware:

• TROJ_ARTIEF.XPP

Installation

This backdoor drops the following component file(s):

• %User Profile%\ntuser.cfg - detected as BKDR_SIMBOT.EOT
• %User Temp%\{random filename}.tmp - detected as TROJ_PPHATE.A

(Note: %User Profile% is the current user's profile folder, which is usually C:\Windows\Profiles\{user name} on Windows 98 and ME, C:\WINNT\Profiles\{user name} on Windows NT, and C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003.. %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003.)

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• NTUserCfg
• efcc ilitat

Autostart Technique

This backdoor adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTUCF = rundll32 %User Profile%\ntuser.cfg,Config

Backdoor Routine

This backdoor connects to the following URL(s) to send and receive commands from a remote malicious user:

• {BLOCKED}.{BLOCKED}.206.150:80

Dropping Routine

This backdoor executes the dropped file(s). As a result, malicious routines of the dropped files are exhibited on the affected system.

Download Routine

This backdoor connects to the following website(s) to download and execute a malicious file:

• http://{BLOCKED}.{BLOCKED}Z.info/apps/fc.asp
• http://{BLOCKED}.{BLOCKED}Z.info/apps/dw.html

As of this writing, the said sites are inaccessible.