BKDR_VB.AZI

This backdoor has certain capabilities.

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It connects to Internet Relay Chat (IRC) servers. It executes commands from a remote malicious user, effectively compromising the affected system.

Arrival Details

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This backdoor drops the following copies of itself into the affected system:

• %User Temp%\HKCwin32.exe

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003.)

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• ASKDhf2y928SDHasl

It is injected into the following processes running in memory:

• csrss.exe

Autostart Technique

This backdoor adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
HotKeysCommands = %User Temp%\HKCwin32.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
HotKeysCommands = %User Temp%\HKCwin32.exe

Backdoor Routine

This backdoor opens the following port(s) where it listens for remote commands:

• TCP Port 6969

It connects to any of the following Internet Relay Chat (IRC) servers:

• {BLOCKED}as.{BLOCKED}a2011.com
• {BLOCKED}lz.edu

It joins any of the following IRC channel(s):

• #spmx

It executes the following commands from a remote malicious user:

• clean
• update
• removeo
• unsort
• protleave
• adware
• torrent

It connects to the following URL(s) to send and receive commands from a remote malicious user:

• http://{BLOCKED}s.{BLOCKED}roba.jp

Dropping Routine

This backdoor sets the attributes of its dropped file(s) to the following:

• System
• Hidden
• Read Only

NOTES:

It has the following backdoor capabilities:

• Execute and terminate process
• Download files
• Update itself
• Clean remnants of itself