BKDR_POISON.AKO

This backdoor arrives as an attachment to email messages spammed by other malware/grayware or malicious users.

This backdoor does not have any file infection routine.

It does not have any propagation routine.

It opens a hidden Internet Explorer window. It connects to a website to send and receive information.

It does not have any downloading capability.

Arrival Details

This backdoor may be downloaded from the following remote sites:

• http://{BLOCKED}pdate.org/antivirus/antivirusupdate.exe

Infection Points

This backdoor does not have any file infection routine.

Installation

This backdoor drops the following file(s)/component(s):

• %User Temp%\xz.exe - detected as the same malware

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003.)

It drops the following non-malicious files:

• %Windows%\java\classes\JQB.dll
• %User Temp%\msvc000001a.txt
• %Program Files%\Common Files\ODBC\ODBC.dll

(Note: %Windows% is the Windows folder, which is usually C:\Windows or C:\WINNT.. %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003.. %Program Files% is the default Program Files folder, usually C:\Program Files.)

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• 7-05'rat

Autostart Technique

This backdoor adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Active Setup\Installed Components\{73B2075B-2925-3CDD-64CE-309B5AEB42F2}
StubPath = "%System%:secrm.scr"

Other System Modifications

This backdoor adds the following registry keys as part of its installation routine:

HKEY_CURRENT_USER\Software\WinRAR SFX

Propagation

This backdoor does not have any propagation routine.

Backdoor Routine

This backdoor opens a hidden Internet Explorer window.

It connects to the following websites to send and receive information:

• http://{BLOCKED}9.{BLOCKED}eliver.com

It connects to the following URL(s) to send and receive commands from a remote malicious user:

• {BLOCKED}rus-groups.com

Download Routine

This backdoor does not have any downloading capability.

NOTES:

It arrives as an attachment to email messages spammed by other malware/grayware or malicious users as antivirusupdate.exe.

It creates an Alternate Data Stream (ADS) copy of itself:

• %System%:secrm.scr

This allows the malware to hide itself from detection. It also allows it to execute whenever the System Folder is accessed.

This malware attempts to connect to remote site to send and receive information/commands. The routines to perform may vary depending on the remote user’s commands. Through a command, it may be able to steal information such as keystrokes.

This malware does not have rootkit capabilities.

This malware does not exploit any vulnerability.