BKDR_FYNLOS.SM1

This backdoor arrives as an attachment to email messages spammed by other malware/grayware or malicious users. It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. It may be dropped by other malware.

It does not have any propagation routine.

It does not drop any other file.

It does not have any information-stealing capability.

Arrival Details

This backdoor arrives as an attachment to email messages spammed by other malware/grayware or malicious users.

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It may be dropped by the following malware:

• BKDR_FYNLOS.SM

Propagation

This backdoor does not have any propagation routine.

Backdoor Routine

This backdoor opens the following ports:

• 80

It connects to the following URL(s) to send and receive commands from a remote malicious user:

• {BLOCKED}3.{BLOCKED}8.242.84

Dropping Routine

This backdoor does not drop any other file.

Information Theft

This backdoor does not have any information-stealing capability.

Other Details

This backdoor connects to the following URL(s) to check for an Internet connection:

• http://www.google.com/search?qu=

NOTES:
It connects to its command-and-control(C&C) server using the parameter:

• /search{numbers}?h1={value}&h2={value}&h3={encoded computer name}&h4={encoded volume serial number}

• Download and upload files
• Execute, delete or copy files
• List or terminate processes
• List or change directories
• Perform shell commands

It does not have rootkit capabilities.

It does not exploit any vulnerability.