PE_BAMITAL.SME

This file infector searches for files in %System%\dllcache and %System%. Once found, it infects the said files using Entry Point Obscuring (EPO) technique. Before proceeding with its payload, it first checks if it is being run by the local system, by checking if the SID starts with "S-1-5-18". It does not proceed if the SID is different.

If infection is successful, it attempts to access several randomly generated servers. It appends strings to the certain domain names.

This file infector arrives as a component bundled with malware/grayware packages. It may be unknowingly downloaded by a user while visiting malicious websites.

It modifies registry entries to enable its automatic execution at every system startup.

Arrival Details

This file infector arrives as a component bundled with malware/grayware packages.

It may be unknowingly downloaded by a user while visiting malicious websites.

Installation

This file infector drops the following non-malicious files:

• %Windows%\expl.dat
• %System%\dllc.dat
• %System%\svch.dat
• %System%\winl.dat

(Note: %Windows% is the Windows folder, which is usually C:\Windows or C:\WINNT.. %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.)

It drops the following copies of itself into the affected system:

• %Application Data%\MicrosoftNT\winserver.exe

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Windows\Profiles\{user name}\Application Data on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Application Data on Windows NT, and C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, XP, and Server 2003.)

It creates the following folders:

• %Application Data%\MicrosoftNT

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Windows\Profiles\{user name}\Application Data on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Application Data on Windows NT, and C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, XP, and Server 2003.)

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• 11expl22
• 11svch22

Autostart Technique

This file infector modifies the following registry entries to ensure it automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
User Shell Folders
Startup = %Application Data%\MicrosoftNT

(Note: The default value data of the said registry entry is %User Startup%.)

Other System Modifications

This file infector adds the following registry entries as part of its installation routine:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Temp
Uses32 = {hex values}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Temp
TimeGetWork = {dword value}

Other Details

This file infector connects to the following URL(s) to check for an Internet connection:

• google.com

NOTES:

This file infector searches for the following files in %System%\dllcache and %System%:

• explorer.exe
• svchost.exe
• winlogon.exe

Once found, it infects the said files using Entry Point Obscuring (EPO) technique.

Before proceeding with its payload, the malware first checks if it is being run by the local system, by checking if the SID starts with "S-1-5-18". It does not proceed if the SID is different.

If infection is successful, it attempts to access several randomly generated servers:

• {15randomchars}.co.cc
• {15randomchars}.cz.cc
• {15randomchars}.info
• {15randomchars}.in

It appends the following strings to the above-mentioned domain names:

• /m.{BLOCKED}id={id}&pr={value}&os={value_os}&id={processor_info}&ver={value_ver}&ver={value_ver}