BKDR_FAKETM.AA

This backdoor arrives as an attachment to email messages spammed by other malware/grayware or malicious users. It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It does not have any propagation routine.

However, as of this writing, the said sites are inaccessible.

It does not have any downloading capability.

It does not have any information-stealing capability.

It deletes itself after execution.

Arrival Details

This backdoor arrives as an attachment to email messages spammed by other malware/grayware or malicious users.

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This backdoor drops and executes the following files:

• %Desktop%\cesrss.exe - also detected as BKDR_FAKETM.AA

(Note: %Desktop% is the current user's desktop, which is usually C:\Windows\Profiles\{user name}\Desktop on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Desktop on Windows NT, and C:\Documents and Settings\{User Name}\Desktop on Windows 2000, XP, and Server 2003.)

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• 015d94dsf

Autostart Technique

This backdoor creates the following registry entries to enable automatic execution of dropped component at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
adobe PrintfStream = "%Desktop%\cesrss.exe"

Propagation

This backdoor does not have any propagation routine.

Backdoor Routine

This backdoor connects to the following URL(s) to send and receive commands from a remote malicious user:

• {BLOCKED}.{BLOCKED}.138.162

However, as of this writing, the said sites are inaccessible.

Download Routine

This backdoor does not have any downloading capability.

Information Theft

This backdoor does not have any information-stealing capability.

Other Details

This backdoor deletes itself after execution.

NOTES:

Upon execution, this backdoor checks if the currently logged on user of the affected system has administrator rights. If it does, it copies %Desktop%\cesrss.exe to an alternate data stream (ADS) and saves as %System%:PrintfStrea.exe.

It then adds/modifies the following registry entry:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
adobe PrintfStream = "%System%:PrintfStrea.exe"

This backdoor queries the default web browser by accessing the following registry key:

HKEY_CLASSES_ROOT\http\shell\open\command

It then launches a hidden web browser process where it injects its code in the said process. The injected code contains its backdoor routines.

It does not have rootkit capabilities.

It does not exploit any vulnerability.