BKDR_CRUGUP.AF

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes commands from a remote malicious user, effectively compromising the affected system.

It sends the information it gathers to remote users via HTTP Post.

Arrival Details

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This backdoor drops the following copies of itself into the affected system and executes them:

• %Application Data%\{Folder Name}\svchost.exe

(Note: %Application Data% is the Application Data folder, where it usually is C:\Documents and Settings\{user name}\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Roaming on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

It creates the following folders:

• %Application Data%\{Folder Name}

(Note: %Application Data% is the Application Data folder, where it usually is C:\Documents and Settings\{user name}\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Roaming on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• GH5K-GKL8-CPP4-DE24

Autostart Technique

This backdoor adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
z64_kernel = %Application Data%\{Folder Name}\svchost.exe

HKEY_CURRENT_USER\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
z64_kernel = %Application Data%\{Folder Name}\svchost.exe

Other System Modifications

This backdoor adds the following registry entries:

HKEY_CURRENT_USER\Software\cppguru
mv = Mi4wNQ== (base64 encoded version = 2.05)

It creates the following registry entry(ies) to bypass Windows Firewall:

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\AuthorizedApplications\
List
%Application Data%\{Folder Name}\svchost.exe = %Application Data%\{Folder Name}\svchost.exe:*:Enabled:svchost.exe
for Windows XP and Windows 2003

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\
services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\AuthorizedApplications\
List
%Application Data%\{Folder Name}\svchost.exe = %Application Data%\{Folder Name}\svchost.exe:*:Enabled:svchost.exe
for Windows XP and Windows 2003

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\
services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\AuthorizedApplications\
List
%Application Data%\{Folder Name}\svchost.exe = %Application Data%\{Folder Name}\svchost.exe:*:Enabled:svchost.exe
for Windows XP and Windows 2003

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\AuthorizedApplications\
List
%Application Data%\{Folder Name}\svchost.exe = %Application Data%\{Folder Name}\svchost.exe:*:Enabled:svchost.exe
for Windows XP and Windows 2003

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
services\SharedAccess\Parameters\
FirewallPolicy\FirewallRules
{GUID} = v{version number}|Action=Allow|Active=TRUE|Dir=In|App=%Application Data%\{Folder Name}\svchost.exe|Name=madservice|
for Windows 7, Windows 8 and Windows Vista

Backdoor Routine

This backdoor executes the following commands from a remote malicious user:

• Use Internet Explorer to connect to remote sites
• Download and execute file
• Update itself
• Delete itself
• Perform denial of service attacks

It connects to the following URL(s) to send and receive commands from a remote malicious user:

• http://{BLOCKED}egtxx.ws/gamers/index.php

As of this writing, the said sites are inaccessible.

Download Routine

This backdoor saves the files it downloads using the following names:

• %Application Data%\sqlite3.dll
• %Application Data%\mg.exe

(Note: %Application Data% is the Application Data folder, where it usually is C:\Documents and Settings\{user name}\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Roaming on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

Information Theft

This backdoor gathers the following data:

• Volume serial number
• OS Version
• If the machine is running with administrative priviliges

Drop Points

This backdoor sends the information it gathers to remote users via HTTP Post.

NOTES:

The variable {Folder Name} in the entries above is the first eight digits of the Volume Serial Number.

It uses the following User Agents:

• Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.0.5) Gecko/20060731 Firefox/1.5.0.5 Flock/0.7.4.1
• Mozilla/5.0 (X11; U; Linux 2.4.2-2 i586; en-US; m18) Gecko/20010131 Netscape6/6.01
• Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 6.2; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
• Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.2; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
• Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:0.9.6) Gecko/20011128
• Mozilla/4.0 (MobilePhone SCP-5500/US/1.0) NetFront/3.0 MMP/2.0 (compatible; Googlebot/2.1; http://www.google.com/bot.html)
• Mozilla/4.0 (Windows; U; Windows NT 6.1; nl; rv:1.9.2.3) Gecko/20100401 Firefox/3.6.3
• Mozilla/4.0 (Windows NT 5.1; U; en) Presto/2.5.22 Version/10.50
• Mozilla/4.0 Galeon/1.2.0 (X11; Linux i686; U;) Gecko/20020326
• Opera/10.80 (SunOS 5.8 sun4u; U) Opera 10.8 [en]

It restarts the affected system if it is able to find these following files in the process folder path of running processes:

• ollydbg.ini
• Symsrv.dll
• SDRemote.dll
• icedat.dll
• nmtrans.dll
• srcsrv.dll
• ImmunityDebugger.ini
• ida.key
• libdwarf.dll

It creates the following files then deletes it afterwards:

• {malware path}\per which contains the following strings:
  
  • "{registry key} [7]" - to make the registry key have a Full Access permission
  • "{registry key} [8]" - to make the registry key Read Access permission

The variable {registry key} may be any of the following:

• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
• HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

It executes the following commands to change the registry access permission:

• regini per

It prevents the manual removal of the dropped copy of itself by executing the following command to change the permission to read or execute:

• cmd /c echo Y|CACLS {%Application Data%\(Folder Name)\svchost.exe} /P {User Name}:R
• cmd /c echo Y|CACLS {%Application Data%\(Folder Name)} /P {User Name}:R