BKDR_MATSNU.EJ

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes commands from a remote malicious user, effectively compromising the affected system.

Arrival Details

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This backdoor drops the following copies of itself into the affected system and executes them:

• %User Temp%\{random file name 2}.pre - deleted afterwards
• %User Temp%\{random folder name}\{random 1}tvyz.exe

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.)

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• LDRBCCE01

It injects codes into the following process(es):

• svchost.exe
• ctfmon.exe
• explorer.exe

Autostart Technique

This backdoor adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
{random 2}tvyz.exe = "%User Temp%\{random folder name}\{random 1}tvyz.exe"

Backdoor Routine

This backdoor executes the following commands from a remote malicious user:

• Download and execute/load arbitrary .exe and .dll files
• Update itself
• Update C&C servers
• Delete ntldr and ntdetect.com, then wipe MBR
• Lock/unlock computer

It connects to the following URL(s) to send and receive commands from a remote malicious user:

• http://{BLOCKED}xrz.com/typo3.php
• http://{BLOCKED}ect-proxy.com/typo3.php
• http://{BLOCKED}nes.com/t.php
• http://{BLOCKED}line.com/t.php
• http://{BLOCKED}olderxx.com/forums.php
• http://{BLOCKED}bspace-apo.com/forums.php
• http://{BLOCKED}eg.com/forums.php
• http://{BLOCKED}k-gt.com/t po3.php
• http://{BLOCKED}xrz.com/typo3.php
• http://{BLOCKED}ect-proxy.com/typo3.php
• http://{BLOCKED}nes.com/t.php
• http://{BLOCKED}line.com/t.php
• http://{BLOCKED}olderxx.com/forums.php
• http://{BLOCKED}bspace-apo.com/forums.php

It posts the following information to its command and control (C&C) server:

• Disk serial number
• Attack status
• Location
• OS version

Other Details

This backdoor displays the following message boxes:

NOTES:
It terminates itself if the following string is found in its file path:

• sand-box