BKDR_NFLOG.AV

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes commands from a remote malicious user, effectively compromising the affected system.

It executes the downloaded files. As a result, malicious routines of the downloaded files are exhibited on the affected system.

Arrival Details

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This backdoor drops the following file(s)/component(s):

• %Temp%\$NtUninstallKB942388$ - Contains stolen information
• %Temp%\NfIpv6.ocx - Also detected as BKDR_NFLOG.AV
• %Temp%\YahooCache.ini

(Note: %Temp% is the Windows Temporary folder, which is usually C:\Windows\Temp.)

It injects itself into the following processes as part of its memory residency routine:

• svchost.exe

Autostart Technique

This backdoor registers itself as a system service to ensure its automatic execution at every system startup by adding the following registry entries:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\IPRIP
Type = "20"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\IPRIP
Start = "2"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\IPRIP
ErrorControl = "1"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\IPRIP
ImagePath = "%SystemRoot%\System32\svchost.exe -k netsvcs"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\IPRIP
DisplayName = "IPv6 Stack Local Support"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\IPRIP
ObjectName = "LocalSystem"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\IPRIP
Description = "Net address translation for IPv6 Protocol."

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\IPRIP\Parameters
ServiceDll = "{malware path and filename}"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\IPRIP\Security
Security = "{hex values}"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\IPRIP\Parameters
ServiceDll = %Temp%\NfIpv6.ocx

Other System Modifications

This backdoor adds the following registry keys:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\IPRIP

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\IPRIP\Parameters

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\IPRIP\Security

It adds the following registry entries:

HKEY_USERS\.DEFAULT\Software\
Microsoft\Clock
HID = "{hex values}"

It modifies the following registry entries:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Internet Settings\
Cache\Paths
Directory = "NetworkService's %Temporary Internet Files%\Content.IE5"

(Note: The default value data of the said registry entry is %Temporary Internet Files%\Content.IE5.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Internet Settings\
Cache\Paths\path1
CachePath = "NetworkService's %Temporary Internet Files%\Content.IE5\Cache1"

(Note: The default value data of the said registry entry is %Temporary Internet Files%\Content.IE5\Cache1.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Internet Settings\
Cache\Paths\path2
CachePath = "NetworkService's %Temporary Internet Files%\Content.IE5\Cache2"

(Note: The default value data of the said registry entry is %Temporary Internet Files%\Content.IE5\Cache2.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Internet Settings\
Cache\Paths\path3
CachePath = "NetworkService's %Temporary Internet Files%\Content.IE5\Cache3"

(Note: The default value data of the said registry entry is %Temporary Internet Files%\Content.IE5\Cache3.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Internet Settings\
Cache\Paths\path4
CachePath = "NetworkService's %Temporary Internet Files%\Content.IE5\Cache4"

(Note: The default value data of the said registry entry is %Temporary Internet Files%\Content.IE5\Cache4.)

Backdoor Routine

This backdoor executes the following commands from a remote malicious user:

• Download files
• Perform remote shell
• Retrieve system information
• Update self

It connects to the following URL(s) to send and receive commands from a remote malicious user:

• http://{BLOCKED}t194.{BLOCKED}n.com/norton/Nfile.asp
• http://{BLOCKED}t194.{BLOCKED}n.com/norton/NfStart.asp
• http://{BLOCKED}t194.{BLOCKED}n.com/norton/TTip.asp
• http://{BLOCKED}t194.{BLOCKED}n.com/norton/NfHostInfo.as
• http://{BLOCKED}t194.{BLOCKED}n.com/norton/NfCommand.asp
• http://{BLOCKED}t194.{BLOCKED}n.com/norton/NfStart.asp
• http://{BLOCKED}t194.{BLOCKED}n.com/norton/Nfpredown.asp
• http://{BLOCKED}t194.{BLOCKED}n.com/norton/NfCommand.asp

It posts the following information to its command and control (C&C) server:

• IP configuration
• Network statistics
• Running processes
• Running services
• System information

Download Routine

This backdoor accesses the following websites to download files:

• http://{BLOCKED}t194.{BLOCKED}n.com/norton/Nfile.asp

It saves the files it downloads using the following names:

• %Temp%\MSMAPI.OCX - also detected as BKDR_NFLOG.AV

(Note: %Temp% is the Windows Temporary folder, which is usually C:\Windows\Temp.)

It then executes the downloaded files. As a result, malicious routines of the downloaded files are exhibited on the affected system.

Other Details

This backdoor requires the existence of the following files to properly run:

• %Temp%\YahooCache.ini

(Note: %Temp% is the Windows Temporary folder, which is usually C:\Windows\Temp.)

NOTES:

This backdoor reports system infection by sending IP address and infection time to the following URL via HTTP post:

• http://{BLOCKED}t194.{BLOCKED}n.com/norton/NfStart.asp