BKDR_GBOT.D

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes commands from a remote malicious user, effectively compromising the affected system.

Arrival Details

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This backdoor drops the following copies of itself into the affected system and executes them:

• %User Temp%\winsvchost\svchost.exe

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.)

It creates the following folders:

• %User Temp%\winsvchost

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.)

Autostart Technique

This backdoor adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\policies\
Explorer\Run
Update service = "%User Temp%\winsvchost\svchost.exe"

Backdoor Routine

This backdoor executes the following commands from a remote malicious user:

• simplehttpflood - HTTP flooding in simple mode
• httpflood - HTTP flooding
• oldhttpflood - HTTP/HTTPS flooding in the old mode
• intoldhttpflood - HTTP/HTTPS flooding in the old intellectual mode
• inthttpflood - HTTP flooding in intelligent mode (used to monitor user activity)
• highhttpflood - HTTP flooding in aggressive mode
• posthttpflood - HTTP flooding (POST)
• intposthttpflood - HTTP flooding in intelligent mode
• icmpflood - ICMP flooding
• inticmpflood - ICMP flooding in intelligent mode
• newtimeout - Change pause between requests
• stop - cancel previous command
• update - update itself

It connects to the following URL(s) to send and receive commands from a remote malicious user:

• http://{BLOCKED}n.com/xx/getcmd.php?id=-{Malware ID}&traff=0

Information Theft

This backdoor attempts to steal stored account information used in the following installed File Transfer Protocol (FTP) clients or file manager software:

• FlashFXP
• FileZilla
• SmartFTP
• GHISLER
• ALFTP

It gathers the following account information from any of the mentioned File Transfer Protocol (FTP) clients or file manager software:

• User ID
• Host Name
• Password
• Port Number