BKDR_SINOWAL.CON

This backdoor may be downloaded by other malware/grayware/spyware from remote sites.

It executes commands from a remote malicious user, effectively compromising the affected system.

Arrival Details

This backdoor may be downloaded by other malware/grayware/spyware from remote sites.

Installation

This backdoor drops the following files:

• %All Users Profile%\Application Data\{random number 1}\{random number}.dat - contains hex value of its file name
• %All Users Profile%\Application Data\{random number 1}\{random number}.dll - contains hex value of its file name
• %All Users Profile%\Application Data\{random number 1}\{dat name}.dat - config file
• %All Users Profile%\Application Data\{random number 1}\{dll name}.dll - also detected as BKDR_SINOWAL.CON

(Note: %All Users Profile% is the All Users or Common profile folder, which is C:\Documents and Settings\All Users in Windows 2000, XP, and Server 2003, and C:\ProgramData in Windows Vista and 7.)

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• WBJODCMBARTOJIFNOYOCMCWBFUQ
• WBJODCMBARTOJIFNOYOCMCWBFUQ-{number}

Autostart Technique

This backdoor adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CLASSES_ROOT\CLSID\{GUID}\
InprocServer32
(Default) = "%All Users Profile%\Application Data\{random number 1}\{dll name}.dll"

HKEY_CURRENT_USER\Software\Classes\
CLSID\{GUID}\InprocServer32
(Default) = "%All Users Profile%\Application Data\{random number 1}\{dll name}.dll"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\ShellServiceObjectDelayLoad
{value name} = "{GUID}"

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\Windows
AppInit_DLLs = "%All Users Profile%\Application Data\{random number 1}\{dll name}.dll"

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\Windows
LoadAppInitDLLs = "1"

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\Windows
RequireSignedAppInit_DLLs = "0"

Backdoor Routine

This backdoor executes the following commands from a remote malicious user:

• Download arbitrary files

It connects to the following URL(s) to send and receive commands from a remote malicious user:

• http://{BLOCKED}finalize.biz/search2?fr=altavista&itag=ody&q=443b40b41d25b91dd9a4104278083c14%2Cf4f535b835f5429b&kgs=1&kls=0&p={parameter}
• http://{BLOCKED}.{BLOCKED}.12.2/search2?fr=altavista&itag=ody&q=443b40b41d25b91dd9a4104278083c14%2Cf4f535b835f5429b&kgs=1&kls=0&p={parameter}

It posts the following information to its command and control (C&C) server:

• List of running processes
• Applications installed in the system (found in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall)

As of this writing, the said servers are currently inaccessible.

NOTES:

This backdoor suspends the thread of Trusteer Rapport software if found running in the processes of the following browsers: chrome.exe firefox.exe iexplore.exe opera.exe

It displays a message box with the following contents if avgui.exe is found running in the system:

Title: Thank you
Message: Thank you for using AVG Product!

{dll name} can be any of the following:

• lmbd
• mmdd
• mscc
• msdd
• msdr
• msee
• msseedir
• mswd
• wsse

{dat name} can be any of the following:

• ccdxmmde
• colu
• drss
• du44
• elct
• i3u4
• ii33
• jdlr
• kdkd
• ned9
• nudr
• qnud
• rrxx
• uloc
• vvve
• werr
• xdor
• xes2

{GUID} can be any of the following:

• {118BEDCC-A901-4203-B4F2-ADCB957D1887}
• {212B3DCC-A901-4203-B4F2-ADCB957D1887}
• {312BED3C-A901-4203-B4F2-ADCB957D1887}
• {312BFDCE-A901-4203-B4F2-ADCB957D1887}
• {A12BEDCC-A901-4203-B4F2-ADCB957D1887}
• {F12BE2CC-A901-4203-B4F2-ADCB957D1887}

{value name} can be any of the following:

• Copier
• CopierMircosoft
• MSCPY
• MSCopy
• MicrosoftCopy
• WindowsCopy

This backdoor executes its .DLL component by using the following command:

• %System%\cmd.exe /c %System%\regsvr32.exe /s "%All Users Profile%\Application Data\{dll name}.dll"