Backdoor.Win32.PLUGX.EYSGVM

This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It drops copies of itself in all removable drives.

It executes commands from a remote malicious user, effectively compromising the affected system.

Arrival Details

This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Backdoor adds the following folders:

• %ProgramData%\AvastSvcPYT → if it executes without a {random numbers} in the commandline
• {Drive}\RECYCLER.BIN

(Note: %ProgramData% is a version of the Program Files folder where any user on a multi-user computer can make changes to programs. This contains application data for all users. This is usually C:\ProgramData on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit), or C:\Documents and Settings\All Users on Windows Server 2003(32-bit), 2000(32-bit) and XP.)

It drops the following files:

• %ProgramData%\AvastSvcPYT\AvastSvc.exe → if it executes without a {random numbers} in the commandline
• %ProgramData%\AvastSvcPYT\AvastAuth.dat → if it executes without a {random numbers} in the commandline
• %ProgramData%\AvastSvcPYT\wsc.dll → if it executes without a {random numbers} in the commandline

(Note: %ProgramData% is a version of the Program Files folder where any user on a multi-user computer can make changes to programs. This contains application data for all users. This is usually C:\ProgramData on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit), or C:\Documents and Settings\All Users on Windows Server 2003(32-bit), 2000(32-bit) and XP.)

It adds the following processes:

• %ProgramData%\AvastSvcPYT\AvastSvc.exe {random numbers} → if it executes without a {random numbers} in the commandline

(Note: %ProgramData% is a version of the Program Files folder where any user on a multi-user computer can make changes to programs. This contains application data for all users. This is usually C:\ProgramData on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit), or C:\Documents and Settings\All Users on Windows Server 2003(32-bit), 2000(32-bit) and XP.)

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• ygBcnyAKmDRFCFJQmDkn
• USB_NOTIFY_COP_{Drive letter}
• USB_NOTIFY_INF_{Drive letter}

Autostart Technique

This Backdoor adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
AvastSvcPYT = "%ProgramData%\AvastSvcPYT\AvastSvc.exe" {random numbers} → if it executes without a {random numbers} in the commandline

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
AvastSvcPYT = "%ProgramData%\AvastSvcPYT\AvastSvc.exe" {random numbers} → if it executes without a {random numbers} in the commandline

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\Network
Version = 1 → if commandline is -net

HKEY_CURRENT_USER\System\CurrentControlSet\
Control\Network
Version = 1 → if commandline is -net

Other System Modifications

This Backdoor adds the following registry entries:

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
ms-pu
CLSID = {hex values}

Propagation

This Backdoor drops copies of itself in all removable drives.

It creates shortcut files (.LNK) disguised as folders or files located on the affected drives pointing to the malware copy.

Backdoor Routine

This Backdoor executes the following commands from a remote malicious user:

• Get system information
• Start pipe communication
• Echo back given input
• Exit process
• Get disk information
• Manage file (query, read, write, delete, copy, rename, move)
• Create directory
• Get expanded environment variable
• Get malware directory
• Execute arbitrary command

It connects to the following URL(s) to send and receive commands from a remote malicious user:

• {BLCOKED}.{BLOCKED}.53.106

Rootkit Capabilities

This Backdoor does not have rootkit capabilities.

Process Termination

This Backdoor terminates the following processes if found running in the affected system's memory:

• AdobeHelper.exe
• AdobeUpdates.exe
• AdobeUpdate.exe
• AdobeARM.exe
• AAM Update.exe
• AAM Updates.exe

Information Theft

Upon execution of the affected application, it gathers the following information:

• Results of the following commands:
  • systeminfo (Details about the operating system and the system hardware and software components)
  • ipconfig (Details about current TCP/IP network configuration)
  • netstat (Details about current TCP connections)
  • arp (Details about local ARP cache)
  • tasklist (Details about running processes)

It accepts the following parameters:

• -net → set the value of key registry “System\CurrentControlSet\Control\Network\Version” to “1”

Other Details

This Backdoor adds the following registry keys:

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
ms-pu

HKEY_USER\{SID}_CLASSES\ms-pu

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
ms-pu\PROXY

It connects to the following URL(s) to check for an Internet connection:

• https://www.microsoft.com

It requires the existence of the following files to properly run:

• AvastAuth.dat → Backdoor.Win32.PLUGX.EYSGVM.enc

It does the following:

• It deletes all files found in the folder of the terminated process.
• It deletes the folder of the terminated process.
• It modifies {Drive}\RECYCLER.BIN to point to the system's Recycle Bin.
• It drops the following files inside {Drive}\RECYCLER.BIN:
  • tmp.bat (Contains commands to query system information)
  • c3lzLmluZm8 (Contains results of queried system information)
  • CEFHelper.exe (Copy of the parent executable that loaded the malware)
  • AvastAuth.dat (Copy of the encrypted component needed to execute the malware)
  • wsc.dll (Copy of the malware)
  • {Base64-encoded file names} (Encrypted version of files with the extensions .doc, .docx, .ppt, .pptx, .xls, .xlsx, .pdf)
• It hides the normal counterpart of the malicious shortcut files created in the removable drives.

It does not exploit any vulnerability.