BKDR_ZACCESS.YM

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. It may be downloaded by other malware/grayware from remote sites.

It executes commands from a remote malicious user, effectively compromising the affected system.

It deletes itself after execution.

Arrival Details

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It may be downloaded by the following malware/grayware from remote sites:

• TSPY_FAREIT.TO

Installation

This backdoor drops the following file(s)/component(s):

• %System Root%\RECYCLER\S-1-5-18\${random}\@ - Detected as Mal_Xin12
• %System Root%\RECYCLER\S-1-5-18\${random}\n - Detected as TROJ_SIREFEF.AFP
• %System Root%\RECYCLER\S-1-5-21-{random}\$I{random} - Contains stolen information
• %System Root%\RECYCLER\S-1-5-21-{random}\$R{random} - Contains stolen information
• %System Root%\RECYCLER\S-1-5-21-{random}\${random}\@ - Detected as Mal_Xin12
• %System Root%\RECYCLER\S-1-5-21-{random}\${random}\n - Detected as TROJ_SIREFEF.AFP

(Note: %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.)

It creates the following folders:

• %System Root%\RECYCLER\S-1-5-18\${random}
• %System Root%\RECYCLER\S-1-5-21-{random}
• %System Root%\RECYCLER\S-1-5-21-{random}\${random}

(Note: %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.)

It injects threads into the following normal process(es):

• services.exe

Other System Modifications

This backdoor adds the following registry keys:

HKEY_CURRENT_USER\Software\Classes\
CLSID\{random}

HKEY_CURRENT_USER\Software\Classes\
CLSID\{random}\InprocServer32

It adds the following registry entries:

HKEY_CURRENT_USER\Software\Classes\
CLSID\{random}\InprocServer32
ThreadingModel = "Both"

HKEY_CURRENT_USER\Software\Classes\
CLSID\{random}\InprocServer32
(Default) = "%System Root%\RECYCLER\S-1-5-21-{random}\$BD{random}\n."

It modifies the following registry entries:

HKEY_CLASSES_ROOT\CLSID\{random}\
InprocServer32
(Default) = "%System Root%\RECYCLER\S-1-5-18\$BD{random}\n."

(Note: The default value data of the said registry entry is %System%\wbem\fastprox.dll.)

HKEY_CLASSES_ROOT\CLSID\{random}\
InProcServer32
(Default) = "%System Root%\RECYCLER\S-1-5-21-{random}\$BD{random}\n"

(Note: The default value data of the said registry entry is %System%\SHELL32.dll.)

HKEY_CLASSES_ROOT\CLSID\{random}\
InProcServer32
ThreadingModel = "Both"

(Note: The default value data of the said registry entry is Apartment.)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{random}\InprocServer32
(Default) = "%System Root%\RECYCLER\S-1-5-18\$BD{random}\n."

(Note: The default value data of the said registry entry is %System%\wbem\fastprox.dll.)

It deletes the following registry keys:

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Run\
Windows Defender

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Enum\Root\LEGACY_SHAREDACCESS

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Enum\Root\LEGACY_WSCSVC

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SharedAccess

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\wscsvc

Backdoor Routine

This backdoor executes the following commands from a remote malicious user:

• Get drive information
• Download arbitrary files
• Execute files

It connects to the following URL(s) to send and receive commands from a remote malicious user:

• {BLOCKED}.{BLOCKED}.215.6
• http://{BLOCKED}terbeaclesaapgcbzecj.com/ZmfaT1RVMmmgdj0xLjImaWQ9MTE5MzM1OTYyNiZhaWQ9MzA1MzQmc2lkPTAmb3M9NS4xLTMywvmueI4V

Process Termination

This backdoor terminates the following processes if found running in the affected system's memory:

• MSASCui.exe
• MpCmdRun.exe
• MisSrv.exe
• msseces.exe
• wsctfy.exe
• MsMpSvc
• windefend
• SharedAccess
• iphlpsvc
• wscsvc
• mpssvc
• bfe

Other Details

This backdoor deletes itself after execution.

It accesses the following URL(s) to get the affected system's location:

• http:// j.maxmind.com/app/geoip.js

NOTES:
This malware deletes registries related to Firewall restrictions.