BKDR_RATLD.A

This backdoor may be downloaded by other malware/grayware from remote sites.

It runs certain commands that it receives remotely from a malicious user. Doing this puts the affected computer and information found on the computer at greater risk. It connects to a website to send and receive information.

Arrival Details

This backdoor may be downloaded by the following malware/grayware from remote sites:

• HTML_OBFUSCA.BCS

It may be downloaded from the following remote sites:

• http://www.{BLOCKED}mania.it/img/books.cab

Installation

This backdoor s DLL component is injected to the following process(es):

• McpRoXy.exe
• svchost.exe

Autostart Technique

This backdoor registers its dropped component as a system service to ensure its automatic execution at every system startup. It does this by creating the following registry keys:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\AppMgmt\Parameters
MyStubPath = "{malware path and file name}"

Other System Modifications

This backdoor modifies the following registry entries:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\AppMgmt\Parameters
ServiceDll = "%SystemRoot%\System32\appmgmts.dll"

(Note: The default value data of the said registry entry is {random values}.)

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\AppMgmt\Parameters
ServiceDll = "%User Profile%\AppMgmt.dll"

(Note: The default value data of the said registry entry is {random values}.)

Backdoor Routine

This backdoor executes the following command(s) from a remote malicious user:

• Download file(s)
• Execute file(s)

It connects to the following websites to send and receive information:

• {BLOCKED}.{BLOCKED}.117.132

Dropping Routine

This backdoor drops the following files:

• %User Profile%\AppMgmt.dll - also detected as BKDR_RATLD.A

(Note: %User Profile% is the current user's profile folder, which is usually C:\Windows\Profiles\{user name} on Windows 98 and ME, C:\WINNT\Profiles\{user name} on Windows NT, and C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003.)

NOTES:

If the user is not an administrator, this backdoor does the drops the file %User Profile%\SoundMax.dll, which is also detected as BKDR_RATLD.A. It then creates the following registry key:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
SoundMax = "Rundll32.exe %User Profile%\SoundMax.dll, Launch"