BKDR_XRAT.KVL

This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes commands from a remote malicious user, effectively compromising the affected system.

Arrival Details

This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Backdoor drops the following copies of itself into the affected system and executes them:

• %Application Data%\Brix\brix.exe

(Note: %Application Data% is the Application Data folder, where it usually is C:\Documents and Settings\{user name}\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Roaming on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• eohSEArfS1nJ0SBOsCLroQ1B1nYZnEjM

Backdoor Routine

This Backdoor opens the following port(s) where it listens for remote commands:

• 23558

It executes the following commands from a remote malicious user:

• Initialize itself in the affected system
• Download and execute files
• Upload and execute files
• Uninstall itself
• Screen management
• Get all running processes
• Terminate specified processes
• Start a specified process
• Get all logical drives of the affected system
• Get all files in a specified directory
• Download arbitrary files
• Perform mouse clicks
• Get system information such as username, PC name, MAC address, etc.
• Firewall detection
• Visit a website
• Display message boxes
• Update arbitrary files
• Perform shell commands
• Rename files
• Delete files
• Can shutdown, restart, or suspend the affected system
• Get all startup items
• Add a startup item
• Stop a file from being downloaded

It connects to the following URL(s) to send and receive commands from a remote malicious user:

• {BLOCKED}os.com

Information Theft

This Backdoor gathers the following data:

• Operating System
• Account type of current user
• Geographical location of the affected system (using "freegeoip.net")

Other Details

This Backdoor does the following:

• If the user has administrator privileges, it creates the following registry entries to enable its automatic execution at every system startup:
  • HKEY_LOCAL_MACHINE/Software/Microsoft/Windows/CurrentVersion/Run
    Brix = %Application Data%\Brix\brix.exe
  • HKEY_CURRENT_USER/Software/Microsoft/Windows/CurrentVersion/Run
    Brix = %Application Data%\Brix\brix.exe

(Note: %Application Data% is the Application Data folder, where it usually is C:\Documents and Settings\{user name}\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Roaming on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)