BKDR_NITOL.BD

This backdoor arrives as a file that exports the functions of other malware/grayware. It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. It arrives as a component bundled with malware/grayware packages.

It opens a random port to allow a remote user to connect to the affected system. Once a successful connection is established, the remote user executes commands on the affected system.

It connects to certain URLs. It may do this to remotely inform a malicious user of its installation. It may also do this to download possibly malicious files onto the computer, which puts the computer at a greater risk of infection by other threats.

It deletes itself after execution.

Arrival Details

This backdoor arrives as a file that exports the functions of other malware/grayware.

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It arrives as a component bundled with malware/grayware packages.

Installation

This backdoor drops the following copies of itself into the affected system:

• %System%\{random filename}.dll

(Note: %System% is the Windows system folder, which is usually C:\Windows\System32.)

Its DLL component is injected to the following process(es):

• svchost.exe

Autostart Technique

This backdoor registers itself as a system service to ensure its automatic execution at every system startup by adding the following registry entries:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\6to4
ImagePath = %SystemRoot%\System32\svchost.exe -k netsvcs

It adds and runs the following services:

• 360svc
• netsvcs_{random value}

Other System Modifications

This backdoor adds the following registry entries as part of its installation routine:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\6to4\Parameters
ServiceDll = %System%\{random filename}.dll

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\6to4\Parameters
ServiceMain = StartRouter

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\6to4\Parameters
Security = {random numbers}

Backdoor Routine

This backdoor opens a random port to allow a remote user to connect to the affected system. Once a successful connection is established, the remote user executes commands on the affected system.

Download Routine

This backdoor connects to the following malicious URLs:

• {BLOCKED}1.{BLOCKED}4.175.208

Other Details

This backdoor deletes itself after execution.