BKDR_BIFROSE.DQJ

This backdoor has received attention from independent media sources and/or other security firms.

This backdoor opens a hidden Internet Explorer window.

It logs a user's keystrokes to steal information.

Installation

This backdoor drops the following copies of itself into the affected system:

• %Windows%\calc.exe

(Note: %Windows% is the Windows folder, which is usually C:\Windows or C:\WINNT.)

It drops the following files:

• %Windows%\calc - non-malicious file

(Note: %Windows% is the Windows folder, which is usually C:\Windows or C:\WINNT.)

It injects itself into the following processes running in the affected system's memory:

• EXPLORER.EXE

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• )!VoqA.I4

Autostart Technique

This backdoor adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Tibiabot = %Windows%\calc.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Active Setup\Installed Components\{A607F45D-EB17-BE13-3893-3749250B46A6}
StubPath = %Windows%\calc.exe

Backdoor Routine

This backdoor opens a hidden Internet Explorer window.

It connects to the following URL(s) to send and receive commands from a remote malicious user:

• {BLOCKED}us.no-ip.biz

Information Theft

This backdoor logs a user's keystrokes to steal information.

Stolen Information

The stolen information is saved in the following file:

• %Windows%\calc

(Note: %Windows% is the Windows folder, which is usually C:\Windows or C:\WINNT.)

Other Details

Based on analysis of the codes, it has the following capabilities:

• Arrives bundled with an experimental Mozilla Firefox add-on that when installed, executes malicious file.