BKDR_BIFROSE.BKD

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It does not have any propagation routine.

It executes commands from a remote malicious user, effectively compromising the affected system. It connects to a website to send and receive information.

It does not have any downloading capability.

It deletes the initially executed copy of itself.

Arrival Details

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This backdoor drops the following copies of itself into the affected system:

• %Program Files%\Internet Explorer\IeCheck.exe

(Note: %Program Files% is the default Program Files folder, usually C:\Program Files.)

It stays resident in memory by creating the following process(es):

• svchost.exe

Autostart Technique

This backdoor adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Active Setup\Installed Components\{e3df6b419d1f}
Stubpath = "%Program Files%\Internet Explorer\IeCheck"

Other System Modifications

This backdoor adds the following registry entries:

HKEY_CURRENT_USER\Software\Google
ActiveSettings = "{hex value}"

It adds the following registry keys as part of its installation routine:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Active Setup\Installed Components\{e3df6b419d1f}

Propagation

This backdoor does not have any propagation routine.

Backdoor Routine

This backdoor executes the following commands from a remote malicious user:

• Close opened files
• Create a directory
• Delete a directory (including its contents)
• Delete a file
• Get drive type of all drives
• List contents of the malware's current directory
• Load a .DLL file or open a file
• Move a file
• Open a file
• Open a remote command prompt
• Read from the opened file
• Retrieve email info from the following:
  • Outlook IMAP and POP3
  • Outlook 2002 IMAP and POP3
  • Outlook 2003 IMAP and POP3
• Start a process
• Write to the opened file

It connects to the following websites to send and receive information:

• {BLOCKED}v.{BLOCKED}s.us

Download Routine

This backdoor does not have any downloading capability.

Other Details

This backdoor deletes the initially executed copy of itself

NOTES:

It does not have rootkit capabilities.

It does not exploit any vulnerability.