BKDR_NFLOG.AM

This backdoor may be dropped by other malware.

It executes commands from a remote malicious user, effectively compromising the affected system.

It executes the downloaded files. As a result, malicious routines of the downloaded files are exhibited on the affected system.

Arrival Details

This backdoor may be dropped by the following malware:

• TROJ_NFLOG.AM

Installation

This backdoor injects itself into the following processes as part of its memory residency routine:

• svchost.exe

Autostart Technique

This backdoor registers itself as a system service to ensure its automatic execution at every system startup by adding the following registry entries:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\IPRIP
Type = "20"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\IPRIP
Start = "2"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\IPRIP
ErrorControl = "1"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\IPRIP
ImagePath = "%SystemRoot%\System32\svchost.exe -k netsvcs"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\IPRIP
DisplayName = "IPv6 Stack Local Support"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\IPRIP
ObjectName = "LocalSystem"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\IPRIP
Description = "Net address translation for IPv6 Protocol."

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\IPRIP\Parameters
ServiceDll = "{malware path and filename}"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\IPRIP\Security
Security = "{hex values}"

Other System Modifications

This backdoor adds the following registry keys:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\IPRIP

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\IPRIP\Parameters

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\IPRIP\Security

It adds the following registry entries:

HKEY_CURRENT_USER\Software\Microsoft\
Clock
HID = "{hex values}"

It modifies the following registry entries:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Internet Settings\
Cache\Paths
Directory = "NetworkService's %Temporary Internet Files%\Content.IE5"

(Note: The default value data of the said registry entry is %Temporary Internet Files%\Content.IE5.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Internet Settings\
Cache\Paths\path1
CachePath = "NetworkService's %Temporary Internet Files%\Content.IE5\Cache1"

(Note: The default value data of the said registry entry is %Temporary Internet Files%\Content.IE5\Cache1.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Internet Settings\
Cache\Paths\path2
CachePath = "NetworkService's %Temporary Internet Files%\Content.IE5\Cache2"

(Note: The default value data of the said registry entry is %Temporary Internet Files%\Content.IE5\Cache2.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Internet Settings\
Cache\Paths\path3
CachePath = "NetworkService's %Temporary Internet Files%\Content.IE5\Cache3"

(Note: The default value data of the said registry entry is %Temporary Internet Files%\Content.IE5\Cache3.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Internet Settings\
Cache\Paths\path4
CachePath = "NetworkService's %Temporary Internet Files%\Content.IE5\Cache4"

(Note: The default value data of the said registry entry is %Temporary Internet Files%\Content.IE5\Cache4.)

Backdoor Routine

This backdoor executes the following commands from a remote malicious user:

• Download files
• Perform remote shell
• Retrieve system information
• Update self

It connects to the following URL(s) to send and receive commands from a remote malicious user:

• http://{BLOCKED}6.{BLOCKED}nce.com/NfLog/NfCommand.asp
• http://{BLOCKED}6.{BLOCKED}nce.com/NfLog/NfFile.asp
• http://{BLOCKED}6.{BLOCKED}nce.com/NfLog/NfGetecho.asp
• http://{BLOCKED}6.{BLOCKED}nce.com/NfLog/NfHostInfo.asp
• http://{BLOCKED}6.{BLOCKED}nce.com/NfLog/NfStart.asp
• http://{BLOCKED}6.{BLOCKED}nce.com/NfLog/Nf pda.asp
• http://{BLOCKED}6.{BLOCKED}nce.com/NfLog/Nfpredown.asp
• http://{BLOCKED}6.{BLOCKED}nce.com/NfLog/TTip.asp

It posts the following information to its command and control (C&C) server:

• IP configuration
• Network statistics
• Running processes
• Running services
• System information

Download Routine

This backdoor accesses the following websites to download files:

• http://{BLOCKED}6.{BLOCKED}nce.com/NfLog/NfFile.asp

It saves the files it downloads using the following names:

• %Temp%\MSMAPI.OCX - also detected as BKDR_NFLOG.AM

(Note: %Temp% is the Windows Temporary folder, which is usually C:\Windows\Temp or C:\WINNT\Temp.)

It then executes the downloaded files. As a result, malicious routines of the downloaded files are exhibited on the affected system.

Other Details

This backdoor requires the existence of the following files to properly run:

• %Temp%\YahooCache.ini

(Note: %Temp% is the Windows Temporary folder, which is usually C:\Windows\Temp or C:\WINNT\Temp.)

NOTES:

This backdoor reports system infection by sending IP address and infection time to the following URL via HTTP post:

• http://{BLOCKED}6.{BLOCKED}nce.com/NfLog/NfStart.asp