BKDR_DEMTRANC.AF

This backdoor may be dropped by other malware.

It executes commands from a remote malicious user, effectively compromising the affected system. It connects to a website to send and receive information.

It retrieves specific information from the affected system.

Arrival Details

This backdoor may be dropped by other malware.

Installation

This backdoor drops the following file(s)/component(s):

• %Application Data%\Microsoft\plugin_containor.exe - also detected as BKDR_DEMTRANC.AF

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.)

Autostart Technique

This backdoor creates the following registry entries to enable automatic execution of dropped component at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Plugin Container = "%Application Data%\Microsoft\plugin_containor.exe"

Backdoor Routine

This backdoor executes the following commands from a remote malicious user:

• Terminate Itself (exit)
• Download File (put)
• Idle (sleep)
• Remote Command Line Execution (dos)
• Execute File (run)

It connects to the following websites to send and receive information:

• {BLOCKED}i.{BLOCKED}S.biz/SEU{value}O{value}.jsp?{value}
• {BLOCKED}i.{BLOCKED}S.biz/SUS{value}O{value}.jsp?{value}
• {BLOCKED}i.{BLOCKED}S.biz/ZES{value}O{value}.jsp?{value}
• {BLOCKED}i.{BLOCKED}S.biz/AES{value}O{value}.jsp?{value}
• {BLOCKED}i.{BLOCKED}S.biz/DES{value}O{value}.jsp?{value}

Information Theft

This backdoor retrieves the following information from the affected system:

• Username
• Hostname
• OS Version
• IP Address