BKDR_KULUOZ.MN

This backdoor arrives as attachment to mass-mailed email messages.

It executes commands from a remote malicious user, effectively compromising the affected system. It connects to a website to send and receive information.

It retrieves specific information from the affected system.

Arrival Details

This backdoor arrives as attachment to mass-mailed email messages.

Installation

This backdoor drops the following copies of itself into the affected system:

• %Application Data%\{random}.exe

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.)

It adds the following processes:

• svchost.exe

It leaves the following text files:

• {malware path}\{malware filename}.txt

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• WKJUP2k4

It injects itself into the following processes as part of its memory residency routine:

• created svchost.exe

Autostart Technique

This backdoor adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
{random} = "%Application Data%\{random}.exe"

Other System Modifications

This backdoor adds the following registry keys:

HKEY_CURRENT_USER\SOFTWARE\{random}

It adds the following registry entries as part of its installation routine:

HKEY_CURRENT_USER\SOFTWARE\{random}
{random} = "{hex values}"

Backdoor Routine

This backdoor executes the following commands from a remote malicious user:

• idl - sleep/idle
• run - download and execute arbitrary file
• rem - uninstall itself
• rdl - update copy of injected code in svchost and add encrypted code to registry
• upd - update copy of main malware
• red - check latest malware version

It connects to the following websites to send and receive information:

• {BLOCKED}.{BLOCKED}.131.227:8080/{generated value}
• {BLOCKED}.{BLOCKED}.76.204:8080/{generated value}
• {BLOCKED}.{BLOCKED}.228.66:8080/{generated value}
• {BLOCKED}.{BLOCKED}.164.202:8080/{generated value}
• {BLOCKED}.{BLOCKED}.225.254:8080/{generated value}
• {BLOCKED}.{BLOCKED}.82.94:8080/{generated value}
• {BLOCKED}.{BLOCKED}.144.158:8080/{generated value}

Information Theft

This backdoor retrieves the following information from the affected system:

• Malware Version
• Virtualization Information
• Running Debugger/Forensic Tools
• User name
• Processor type
• OS version
• Antivirus product
• Firewall product

NOTES:

This backdoor checks if there's a running window with the following name:

• 99929D61-1338-48B1-9433-D42A1D94F0D2
• 99929D61-1338-48B1-9433-D42A1D94F0D2-x32
• 99929D61-1338-48B1-9433-D42A1D94F0D2-x64
• APISpy32Class
• Dumper
• Dumper64
• iptools.exe
• Iris - Version 5.59
• prl_cc.exe
• prl_tools.exe
• ProcessHacker
• ProcessLasso_Notification_Class
• PROCEXPL
• PROCMON_WINDOW_CLASS
• SharedIntApp.exe
• Tfrmrpcap
• TSystemExplorerTrayForm.UnicodeClass
• VBoxService.exe
• VBoxTray.exe
• vmsrvc.exe
• vmtoolsd.exe
• vmusrvc.exe
• VMwareDragDetWndClass
• VMwareSwitchUserControlClass
• WdcWindow
• wireshark.exe

It checks Service Disk or BIOS for the following registry information if under virtualization:

• AMIBI
• PRLS
• PTLTD
• Vbox
• Virtual
• VMWare

It also checks if the following registry keys exist:

• SYSTEM\CurrentControlSet\Enum\PCI\VEN_15AD&DEV_0774&SUBSYS_040515AD&REV_00
• SYSTEM\CurrentControlSet\Enum\PCI\VEN_15AD&DEV_0774&SUBSYS_074015AD&REV_00
• SYSTEM\CurrentControlSet\Enum\PCI\VEN_80EE&DEV_CAFE&SUBSYS_00000000&REV_00
• SYSTEM\CurrentControlSet\Enum\PCI\VEN_5333&DEV_8811&SUBSYS_00000000&REV_00
• SYSTEM\CurrentControlSet\Enum\PCI\VEN_80EE&DEV_BEEF&SUBSYS_00000000&REV_00
• HARDWARE\ACPI\DSDT\PTLTD__
• HARDWARE\ACPI\DSDT\VBOX__
• HARDWARE\ACPI\DSDT\AMIBI