BKDR_PLUGX.ABN

October 17, 2013
 Analysis by: Jennifer Gumban
 PLATFORM:

Windows 2000, Windows Server 2003, Windows XP (32-bit, 64-bit), Windows Vista (32-bit, 64-bit), Windows 7 (32-bit, 64-bit)

 OVERALL RISK RATING:
 DAMAGE POTENTIAL:
 DISTRIBUTION POTENTIAL:
 REPORTED INFECTION:
 INFORMATION EXPOSURE:

  • Threat Type: Backdoor

  • Destructiveness: No

  • Encrypted:

  • In the wild: Yes

  OVERVIEW

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It modifies the Internet Explorer Zone Settings.

  TECHNICAL DETAILS

File Size:

237,568 bytes

File Type:

EXE

Initial Samples Received Date:

10 Oct 2013

Arrival Details

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Other System Modifications

This backdoor adds the following registry keys:

HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\
PJM

It adds the following registry entries:

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
MJ
CLSID = "{Random Hex Values}"

Web Browser Home Page and Search Page Modification

This backdoor modifies the Internet Explorer Zone Settings.

Other Details

This backdoor connects to the following possibly malicious URL:

  • http://{BLOCKED}.{BLOCKED}.170.48:443/update?id=000f9b00
  • http://{BLOCKED}.{BLOCKED}.170.48/update?id=000f9b00

It drops the following file(s)/component(s):

  • %All Users Profile%\SxS\bug.log

(Note: %All Users Profile% is the All Users or Common profile folder, which is C:\Documents and Settings\All Users in Windows 2000, XP, and Server 2003, and C:\ProgramData in Windows Vista and 7.)