BKDR_OTOPROXY.WR

This malware uses Malaysia Airlines Flight 370 as its social engineering lure.

To get a one-glance comprehensive view of the behavior of this Backdoor, refer to the Threat Diagram shown below.

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes commands from a remote malicious user, effectively compromising the affected system.

It deletes itself after execution.

Arrival Details

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This backdoor drops the following files:

• %User Temp%\des.z - encrypted exe file(2nd layer), deleted after afterwards
• %User Temp%\big.t - encrypted exe file(1st layer), deleted after afterwards
• %User Temp%\~norry{digit} - decrypted exe file, deleted afterwards
• %User Temp%\cfg.ax - deleted afterwards

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.)

It drops and executes the following files:

• %User Temp%\svchost.exe - also detected as BKDR_OTOPROXY.WR (for Windows XP and lower operating system versions)
• %Program Data%\iexplore.exe - also detected as BKDR_OTOPROXY.WR (for Windows Vista and later operating system versions)

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.)

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• 9c5c8a9e

Autostart Technique

This backdoor adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
serrvice = "%System Root%\programdata\iexplore.exe -help "

Backdoor Routine

This backdoor executes the following commands from a remote malicious user:

• Check installed plugin
• Download plugin
• Register plugin

It connects to the following URL(s) to send and receive commands from a remote malicious user:

• www.dpmc.{BLOCKED}ssl.com via port 80 and 443

Information Theft

This backdoor gathers the following data:

• Host Name
• IP Address

Other Details

This backdoor deletes itself after execution.

NOTES:

This backdoor accepts the parameter -help. It uses 127.0.0.1:8888 as its proxy server.