BKDR_NINDYA.A

Trend Micro has flagged this backdoor application as noteworthy due to the increased potential for damage, propagation, or both, that it possesses. Specifically, it is a file downloaded by a malicious script file, which takes advantage of a 0-day exploit in Firefox.

To get a one-glance comprehensive view of the behavior of this Backdoor, refer to the Threat Diagram shown below.

This backdoor may be downloaded by other malware/grayware from remote sites.

It executes commands from a remote malicious user, effectively compromising the affected system.

Arrival Details

This backdoor may be downloaded by the following malware/grayware from remote sites:

• JS_NINDYA.A

Installation

This backdoor drops the following copies of itself into the affected system:

• %Temp%\symantec.exe

(Note: %Temp% is the Windows Temporary folder, which is usually C:\Windows\Temp or C:\WINNT\Temp.)

Autostart Technique

This backdoor adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Microsoft Windows Update = %Temp%\symantec.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Microsoft Windows Update = %Temp%\symantec.exe

Backdoor Routine

This backdoor opens the following port(s) where it listens for remote commands:

• TCP port 443

It executes the following commands from a remote malicious user:

• Date
• ipconfig
• net start
• dir - to be done in all drives/folders
• tasklist /v
• Taskkill /im
• net user
• net view
• del /s /q *.* - to be done in all drives/folders
• shutdown
• ver
• exit

It connects to the following URL(s) to send and receive commands from a remote malicious user:

• l-3com.{BLOCKED}s.tv (l-3com.{BLOCKED}s-work.com)

Other Details

Based on analysis of the codes, it has the following capabilities:

• Sends back the results of the aforementioned commands back to the remote server.

It connects to the following URL(s) to check for an Internet connection:

• nobel.usagov.mooo.com
• www.update.microsoft.com