BKDR_LUMINOSITY.X

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes commands from a remote malicious user, effectively compromising the affected system.

Arrival Details

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This backdoor drops the following copies of itself into the affected system:

• %User Temp%\SQLi Dumper v.8.0.exe
• %Program Files%\Google\Chrome\Application\Ask Toolbar Chrome.exe
• %Application Data%\svchost\svchost.exe
• %Program Files%\Mozilla Firefox\Ask Toolbar Firefox.exe
• %System%\clientsvr.exe

(Note: %User Temp% is the user's temporary folder, where it usually is C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local\Temp on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.. %Program Files% is the Program Files folder, where it usually is C:\Program Files on all Windows operating system versions; C:\Program Files (x86) for 32-bit applications running on Windows 64-bit operating systems.. %Application Data% is the Application Data folder, where it usually is C:\Documents and Settings\{user name}\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Roaming on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.. %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.)

It adds the following processes:

• ntvdm.exe

Autostart Technique

This backdoor adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Ask Toolbar Chrome = "%Program Files%\Google\Chrome\Application\Ask Toolbar Chrome.lnk"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Ask Toolbar Firefox = "%Program Files%\Mozilla Firefox\Ask Toolbar Firefox.lnk"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Winlogon
Userinit = "userinit.exe,"%System%\clientsvr.exe""

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\RunOnce
svchost = "{malware path}\{malware name}"

HKEY_CURRENT_USER\Software\Microsoft\
Windows NT\CurrentVersion\Winlogon
shell = "explorer.exe,"{malware path}\{malware name}""

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
svchost = "%Application Data%\svchost\svchost.exe"

Backdoor Routine

This backdoor executes the following commands from a remote malicious user:

• Downloads and executes arbitrary files
• Downloads and executes custom Crypto Miner
• Downloads custom password recovery tool
• Searches for files
• Performs DDOS
• Modifies HOSTS file to redirect hosts/URLs
• Visits arbitrary websites (browser can be hidden and have muted audio)
• Seeds torrent
• Updates itself
• Updates backup C&C
• Remotes Desktop Control
• Remotes shell
• Remotes Script
• Records audio using system's microphone
• Controls Webcam
• Uninstalls itself
• Executes/Terminates/Disables Task Manager
• Executes/Terminates/Disables Command Prompt
• Executes/Terminates/Disables Registry Editor
• Hides/Shows Taskbar
• Hides/Shows Desktop
• Opens/Closes CD-ROM door
• Turns on/off user's monitor
• Enables/Disables Keyboard
• Enables/Disables Mouse
• Swaps/Resets Mouse
• Deletes Restore points
• Enables/Disables input
• Logs off User
• Hibernates
• Shutdowns system
• Reboots System
• Performs network speed test
• Manage Files
• Manage Processes
• Gathers the following information:
  
  • Client Overview:
  • Client ID used
  • Country
  • Software Information:
  • User Privilege
  • Machine Name
  • Hardware Information:
  • Machine Type
  • CPU Information
  • GPU Information
  • RAM Information
  • Battery
  • Monitor Count
  • Network Information:
  • WAN address
  • Download Speed
  • LAN Address
  • MAC Address
  • Others:
  • Security information
  • Uptime
  • Active Windows
  • Current malware file location
  • Full OS version
  • Keystroke logs
  • Stored passwords

Other Details

This backdoor does the following:

• It proactively blocks Anti-malware services by querying the installed Anti-Malware/Firewall product in the system. Once an anti-malware/firewall is found, it terminates the corresponding Anti-malware service/process.