BKDR_ANDROM.C

This backdoor arrives as an attachment to email messages spammed by other malware/grayware or malicious users.

It does not have any propagation routine.

It executes commands from a remote malicious user, effectively compromising the affected system.

It does not have any information-stealing capability.

It deletes the initially executed copy of itself.

Arrival Details

This backdoor arrives as an attachment to email messages spammed by other malware/grayware or malicious users.

Installation

This backdoor drops the following copies of itself into the affected system:

• {All User's Profile}\Local Settings\Temp\ms{random characters}.{extension name}
• {All User's Profile}\svchost.exe

It injects codes into the following process(es):

• %Windows%\system32\wuauclt.exe
• %Windows%\syswow64\svchost.exe

(Note: %Windows% is the Windows folder, which is usually C:\Windows.)

Autostart Technique

This backdoor adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
SunJavaUpdateSched = "{All User's Profile}\svchost.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\policies\
Explorer\Run
{random number} = "{All User's Profile}\Local Settings\Temp\ms{random characters}.{extension name}"

Propagation

This backdoor does not have any propagation routine.

Backdoor Routine

This backdoor executes the following commands from a remote malicious user:

• Start a process
• Uninstall itself
• Create registry entries
• Download arbitrary files

It connects to the following URL(s) to send and receive commands from a remote malicious user:

• http://{BLOCKED}d.pl/image.php
• http://{BLOCKED}a.pl/image.php
• http://{BLOCKED}e.pl/image.php
• http://{BLOCKED}m.ru/image.php
• http://{BLOCKED}ge/image.php

Information Theft

This backdoor does not have any information-stealing capability.

Other Details

This backdoor connects to the following URL(s) to check for an Internet connection:

• http://update.microsoft.com

It deletes the initially executed copy of itself

NOTES:

It does not have rootkit capabilities.

It does not exploit any vulnerability.

The extension name of its dropped copy may be any of the following:

• BAT
• CMD
• COM
• EXE
• PIF
• SCR