Backdoor.Win32.VALLEYRAT.J

This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It does not have any propagation routine.

Arrival Details

This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

This Trojan arrives on a system as a file dropped by the loader component Trojan.Win32.VALLEYRAT.K into the following path:

• %ProgramData%\{random}\PdFcorE8.dLL

(Note: %ProgramData% is a version of the Program Files folder where any user on a multi-user computer can make changes to programs. This contains application data for all users. This is usually C:\ProgramData on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit), or C:\Documents and Settings\All Users on Windows Server 2003(32-bit), 2000(32-bit) and XP.)

Installation

This Backdoor adds the following folders:

• %User Temp%\{random}

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It drops the following files:

• %User Temp%\{random}\{random}.{random}
• %AppDataLocalLow%\Microsoft\CryptnetUrlCache\MetaData\{random}
• %AppDataLocalLow%\Microsoft\CryptnetUrlCache\Content\{random}
• %Temporary Internet Files%\IE\{random}\{random}.txt
• %Temporary Internet Files%\IE\{random}\{random}.json

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %AppDataLocalLow% is the LocalLow Application Data folder, which is usually C:\Users\{user name}\AppData\LocalLow on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %Temporary Internet Files% is the Temporary Internet Files folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temporary Internet Files on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Microsoft\Windows\Temporary Internet Files on Windows Vista, 7 and 2008(64-bit), or C:\Users\{user name}\AppData\Local\Microsoft\Windows\INetCache on Windows 8, 8.1, 2012(64-bit) and 10(64-bit).)

Other System Modifications

This Backdoor adds the following registry keys:

HKEY_CURRENT_USER\Console\0\
{random}

HKEY_CURRENT_USER\Software\{random}

HKEY_LOCAL_MACHINE\SOFTWARE\IpDates_i4

It adds the following registry entries:

HKEY_CURRENT_USER\Software\Microsoft\
ActiveMovie\devenum
Version = 7

HKEY_CURRENT_USER\Console\0\
{random}
(Default) = {downloaded encrypted binary payload}

Propagation

This Backdoor does not have any propagation routine.

Backdoor Routine

This Backdoor connects to the following URL(s) to send and receive commands from a remote malicious user:

• acuf444.{BLOCKED}b:9999
• acuf444.{BLOCKED}b:7800 ({BLOCKED}.{BLOCKED}.85.34:7800)
• acuf444.{BLOCKED}b:7811 ({BLOCKED}.{BLOCKED}.85.34:7811)

It uses a custom pipe-delimited protocol with the following parameters for command-and-control communication:

• A1: / S2: / p3: - Primary and secondary C2 server domain/IP
• o1: / o2: / o3: - C2 server ports
• t1: / t2: / t3: - Connection type flags
• dd: - Execution delay (10 seconds)
• cl: - Communication/heartbeat interval (30 seconds)
• fz: - Campaign grouping tag
• bb: - Payload version
• bz: - Configuration build date
• jp: / bh: / ll: / dl: / sh: / kl: / bd: - Capability and module feature flags (all set to 0)

Rootkit Capabilities

It employs rootkit capabilities by extracting an encrypted 64-bit kernel driver (`Alinubx.sys) and dropping it with a randomized filename and extension into `%User Temp%\{random}\{random}.{random}`. It registers and manages the driver via the Windows Service Control Manager:

• Service Name: Alinubx
• Display Name: Alinubx
• Type: Kernel Driver (SERVICE_KERNEL_DRIVER)
• Start Type: Demand Start (SERVICE_DEMAND_START)
• Binary Path: %User Temp%\{random}\{random}.{random}

• Kernel-Level Process Termination: Forcefully kills processes from Ring 0 and bypassing user-mode API hooks and self-protection mechanisms.
• Safe Mode Persistence: Registers service keys under `SafeBoot\Minimal` and `SafeBoot\Network` to ensure the driver remains active even if the system is booted into Safe Mode.

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

Process Termination

This Backdoor terminates the following processes if found running in the affected system's memory:

• A2GUARD.exe
• A2SERVICE.exe
• AAKORE.exe
• AFWSERV.exe
• AHNSD.exe
• ALYAC.exe
• AMSPTELEMETRYSERVICE.exe
• ASPSVC.exe
• ASWENGSRV.exe
• ASWIDSAGENT.exe
• ASWTOOLSSVC.exe
• AVASTBROWSERUPDATE.exe
• AVASTSVC.exe
• AVASTUI.exe
• AVEMUPDATE.exe
• AVG.exe
• AVGNT.exe
• AVGSERV.exe
• AVIRA.SPOTLIGHT.SERVICE.exe
• AVIRA.SPOTLIGHT.SYSTRAY.APPLICATION.exe
• AVKWCTL.exe
• AVP.exe
• AVPSUS.exe
• AVPUI.exe
• AYAGENT.exe
• AYRTSRV.exe
• AYUPDSRV.exe
• AYWSSRV.exe
• BDAGENT.exe
• BDNTWRK.exe
• BDSSVC.exe
• BGCORE.exe
• BSSISS.exe
• BULLGUARD.exe
• BULLGUARDBH.exe
• BULLGUARDUPDATE.exe
• CCSVCHST.exe
• CLAMSCAN.exe
• CLAMTRAY.exe
• CPDA.exe
• CSFALCONSERVICE.exe
• CYBER-PROTECT-SERVICE.exe
• CYBERARK_EA.exe
• CYLANCESVC.exe
• CYLANCEUI.exe
• CYVERASERVICE.exe
• DEFENDERSESSIONHELPER.exe
• EDRAGENT.exe
• EDRSERVICE.exe
• EFWD.exe
• EGUI.exe
• EGUIPROXY.exe
• EKRN.exe
• EMLPROXY.exe
• ENDPOINTPROTECTION.exe
• ENSIGNAGENT.exe
• ENSIGNEDRSERVICE.exe
• ENSIGNSERVICE.exe
• ESERVICEHOST.exe
• FCAUTH.exe
• FORTICLIENT.exe
• FORTIPROXY.exe
• FORTISETTINGS.exe
• FRESHCLAM.exe
• FSAVED.exe
• FSHOSTER.exe
• GDSCAN.exe
• HEALTHMON.exe
• HEIMDAL.MONITOR.exe
• HEIMDALGUARD.exe
• HMPALERT.exe
• ICARUS.exe
• ICARUS_UI.exe
• IGUPDATE.exe
• INTEGOCONTEXT.exe
• INTEGOSERVICE.exe
• INVISIGUARD.exe
• INVISIGUARDSERVICE.exe
• K7AVMSCN.exe
• K7AVQRNT.exe
• K7AVSCAN.exe
• K7CRVSVC.exe
• K7CTSCAN.exe
• K7EMLPXY.exe
• K7FWSRVC.exe
• K7PSSRVC.exe
• K7RTSCAN.exe
• K7SYSMON.exe
• K7TLMTRY.exe
• K7TSALRT.exe
• K7TSECURITY.exe
• K7TSHLPR.exe
• K7TSMAIN.exe
• K7TSMNGR.exe
• K7TSREMINDER.exe
• K7TSUPDT.exe
• K7WS.exe
• K7WSCSHL.exe
• KLNAGENT.exe
• MACMNSVC.exe
• MASVC.exe
• MC-FW-HOST.exe
• MC-NEO-HOST.exe
• MCCSPSERVICEHOST.exe
• MCSAGENT.exe
• MCSCLIENT.exe
• MCSHIELD.exe
• MCUICNT.exe
• MFEAVSVC.exe
• MFEMMS.exe
• MFEVTPS.exe
• MMS.exe
• MMSSHOST.exe
• MODULECORESERVICE.exe
• MPCMDRUN.exe
• MPDEFENDERCORESERVICE.exe
• MSMPENG.exe
• MSSENSE.exe
• NISSRV.exe
• NLLTOOLSSVC.exe
• NORTONSVC.exe
• NORTONUI.exe
• NTRTSCAN.exe
• NVAGENT.exe
• NVSVC.exe
• ONEDRIVE.exe
• ONEDRIVESETUP.exe
• ONEDRIVESTANDALONEUPDATER.exe
• ONLINENT.exe
• OPSSVC.exe
• OVERSEER.exe
• PCCNTMON.exe
• PROTECTEDMODULEHOST.exe
• PTSESSIONAGENT.exe
• PTSVCHOST.exe
• PTWATCHDOG.exe
• QHCCMSVC.exe
• QHPISVR.exe
• QUHLPSVC.exe
• QUICKUP.exe
• REMIND.exe
• REPMGR64.exe
• REPRSVC.exe
• REPUTILS32.exe
• REPUX.exe
• REPWSC64.exe
• SAPISSVC.exe
• SCANNER.exe
• SCANWSCS.exe
• SCSECSVC.exe
• SECURITYHEALTHHOST.exe
• SECURITYHEALTHSERVICE.exe
• SECURITYHEALTHSYSTRAY.exe
• SEDSERVICE.exe
• SENSEIR.exe
• SENTINELAGENT.exe
• SENTINELBROWSERNATIVEHOST.exe
• SENTINELHELPERSERVICE.exe
• SENTINELSERVICEHOST.exe
• SENTINELSTATICENGINE.exe
• SENTRYEYE.exe
• SHIELDANTIVIRUS.exe
• SHIELDANTIVIRUSWS.exe
• SHIELDAVUPDATER.exe
• SHSTAT.exe
• SMARTSCREEN.exe
• SOPHOSCLEAN.exe
• SOPHOSFILESCANNER.exe
• SOPHOSFS.exe
• SOPHOSHEALTH.exe
• SOPHOSNETFILTER.exe
• SOPHOSNTPSERVICE.exe
• SOPHOSSAFESTORE.exe
• SOPHOSUI.exe
• SPSVC.exe
• SSPSERVICE.exe
• SYMCORPUI.exe
• TMBMSRV.exe
• TMLISTEN.exe
• TMPROXY.exe
• TRENDMICROSVC.exe
• TRUEIMAGEHOMESERVICE.exe
• UISEAGNT.exe
• UIWATCHDOG.exe
• UPDATESRV.exe
• V3LITE.exe
• V3RC.exe
• V3SVC.exe
• V3TNOTI.exe
• VCAVSVC.exe
• VCCORERES.exe
• VPNSVC.exe
• VSMON.exe
• VSSERV.exe
• WINDOWSSENSOR.exe
• WSC_PROXY.exe
• WSSRVC.exe

Information Theft

This Backdoor gathers the following data:

• Computer name
• Username and local user SID
• Operating system platform and architecture
• External IP address and geolocation details
• Installed security software and running process list

Other Details

This Backdoor does the following:

• It creates the following service:
  • Service Name: Alinubx
  • Display Name: Alinubx
  • Type: Kernel Driver (SERVICE_KERNEL_DRIVER)
  • Start Type: Demand Start (SERVICE_DEMAND_START)
  • Binary Path: %User Temp%\{random}\{random}.{random}
• Implements fallback payload download routines using legitimate Windows binaries (`curl.exe`, `bitsadmin.exe`, `certutil.exe`)
• It cannot run on its own and needs the previous steps in the attack chain to proceed with its intended routine.

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It does not exploit any vulnerability.