arrow_back
search
close

BKDR_BASUT.A

October 09, 2012
 PLATFORM:

Windows 2000, Windows XP, Windows Server 2003

 OVERALL RISK RATING:
 DAMAGE POTENTIAL:
 DISTRIBUTION POTENTIAL:
 REPORTED INFECTION:

  • Threat Type: Backdoor

  • Destructiveness: No

  • Encrypted: Yes

  • In the wild: Yes

  OVERVIEW

This backdoor opens certain port(s) where it listens for remote commands.

It connects to certain URL(s) to send and receive commands from a remote malicious user.

It modifies the Master Boot Record(MBR).

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It infects the Master Boot Record of the affected system.

  TECHNICAL DETAILS

Ports:

TCP port 8080 (HTTP Alternate)

File Size:

24,576 bytes

Memory Resident:

Yes

Initial Samples Received Date:

25 Jun 2012

Payload:

Connects to URLs/IPs, Compromises system security, Deletes files, Shuts the system down, Restarts system

Arrival Details

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Other System Modifications

This backdoor modifies the following registry entries:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\Session Manager\Memory Management
ClearPageFileAtShutdown = "1"

(Note: The default value data of the said registry entry is 0.)

File Infection

This backdoor infects the Master Boot Record of the affected system in order to perform the following routines:

  • Display black screen and fail to boot

Backdoor Routine

This backdoor opens the following port(s) where it listens for remote commands:

  • 8080
  • 110

It connects to the following URL(s) to send and receive commands from a remote malicious user:

  • {BLOCKED}.197.122
  • {BLOCKED}.212.242
  • {BLOCKED}.232.62
  • {BLOCKED}.218.66
  • {BLOCKED}.62.11

NOTES:

This backdoor changes the password of the Administrator account to HaHaHa_{random}.

It stops the following services:

  • Alerter
  • SENS

It deletes all files found in all drives except files on located in C:\Windows and C:\Program Files folders. But before it deletes a file, it checks if its file extension is similar to any of the following:

  • .accdb
  • .alz
  • .arc
  • .asf
  • .asp
  • .aspx
  • .avi
  • .bak
  • .c
  • .conf
  • .config
  • .cpp
  • .cs
  • .db
  • .db2
  • .dbf
  • .doc
  • .docx
  • .eml
  • .evt
  • .frm
  • .gif
  • .gul
  • .h
  • .htm
  • .html
  • .hwp
  • .inc
  • .ini
  • .iso
  • .java
  • .js
  • .jsp
  • .ldf
  • .log
  • .mdb
  • .mdf
  • .mht
  • .mpg
  • .myd
  • .myi
  • .pck
  • .pdf
  • .php
  • .pkb
  • .pks
  • .plb
  • .pls
  • .png
  • .ppt
  • .pptx
  • .pst
  • .rar
  • .rdo
  • .sql
  • .swf
  • .tif
  • .txt
  • .vb
  • .wmv
  • .xls
  • .xlsx
  • .xml
  • .zip

If the file extension matches with any of the file extensions in the list above, it checks its file size if it is greater than 4 MB. If it is greater than 4 MB, it overwrites the first and last 256 bytes of the file with garbage code. If the file size is not greater than 4MB, it overwrites the first 256 bytes of the file with garbage code.This routine is done to block the recovery of the original deleted file.

It shutdowns and restarts the system.

  SOLUTION

Minimum Scan Engine:

9.200

FIRST VSAPI PATTERN FILE:

9.216.06

FIRST VSAPI PATTERN DATE:

26 Jun 2012

Step 1

For Windows XP and Windows Server 2003 users, before doing any scans, please make sure you disable System Restore to allow full scanning of your computer.

Step 2

Restore your system’s Master Boot Record (MBR)

To restore your system's Master Boot Record (MBR):

  1. Insert your Windows Installation CD into your CD-ROM drive or the USB flash drive then restart your computer.
  2. Press the restart button of your computer.
  3. When prompted, press any key to boot from the CD.
  4. When prompted on the Main Menu, type r to enter the Recovery Console.
    (For Windows 2000 users: After pressing r, type c to choose the Recovery Console on the repair options screen.)
  5. When prompted, type your administrator password to log in.
  6. Once logged in, type the drive that contains Windows in the command prompt that appears, and then press Enter.
  7. Type the following then press Enter:
    fixmbr {affected drive}
    (Note: The affected drive is the bootable drive that this malware/grayware has affected. If no device is specified, the MBR will be written in the primary boot drive.)
  8. Type exit to restart the system.

Step 3

Restore this modified registry value

[ Learn More ]

Important: Editing the Windows Registry incorrectly can lead to irreversible system malfunction. Please do this step only if you know how or you can ask assistance from your system administrator. Else, check this Microsoft article first before modifying your computer's registry.

 
  • In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management
    • From: ClearPageFileAtShutdown = "1"
      To: ClearPageFileAtShutdown = 0

Step 4

Scan your computer with your Trend Micro product to delete files detected as BKDR_BASUT.A. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check this Knowledge Base page for more information.

Step 5

Restore these deleted files from backup

*Note: Only Microsoft-related keys/values will be restored. If this malware/grayware also deleted registry keys/values related to programs that are not from Microsoft, please reinstall those programs on your computer.

Please take note of the technical details.

NOTES:

To restore the Administrator account password:

  1. Open a command prompt.
  2. At the prompt, type the following:
    cmd.exe /c net user Administrator &"{password}&".
  3. Close the command prompt.


Did this description help? Tell us how we did.