BKDR_MORIX.WRG

This backdoor may be downloaded by other malware/grayware from remote sites.

It executes commands from a remote malicious user, effectively compromising the affected system. It connects to a website to send and receive information.

It gathers certain information on the affected computer.

Arrival Details

This backdoor may be downloaded by the following malware/grayware from remote sites:

• JS_LOADER.WRG

It may be downloaded from the following remote sites:

• http://{BLOCKED}.{BLOCKED}.205.102:8888/cx.exe

Installation

This backdoor drops the following component file(s):

• %Program Files%\Common Files\System\seext.dll - also detected as BKDR_MORIX.WRG
• %Program Files%\Windows NT\appgmts.dll - also detected as BKDR_MORIX.WRG
• %System%\wbem\seext.dll - also detected as BKDR_MORIX.WRG
• D:\seext.dll - also detected as BKDR_MORIX.WRG

(Note: %Program Files% is the default Program Files folder, usually C:\Program Files.. %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.)

It drops the following non-malicious files:

• D:\Setup.exe - legitimate 360 Secure Browser component
• %Program Files%\Common Files\System\SPOOLS.EXE - legitimate 360 Secure Browser component

(Note: %Program Files% is the default Program Files folder, usually C:\Program Files.)

Autostart Technique

This backdoor adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\policies\
Explorer\Run
@ = "%Program Files%\Common Files\System\SPOOLS.EXE"

Other System Modifications

This backdoor deletes the following files:

• %System Root%\ntldr.sys

(Note: %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.)

Backdoor Routine

This backdoor executes the following commands from a remote malicious user:

• Log keystrokes
• Modify system settings
• Download and execute file(s)
• Query/modify Terminal Server settings
• Capture video

It connects to the following websites to send and receive information:

• aaaai.{BLOCKED}p.net

Process Termination

This backdoor terminates processes or services that contain any of the following strings if found running in the affected system's memory:

• F-Secure
• ALYac
• Bit-Defend
• AVG
• Avast
• NOD32

Information Theft

This backdoor gathers the following information on the affected computer:

• Computer name
• Processor speed (in MHz)
• Operating system version
• Number of processors
• Total amount of memory (in MB)

NOTES:

This backdoor uses a llegitimate security software file named SETUP.EXE to execute its malicious DLL component SEEXT.DLL. It also does the said routine to avoid being discovered by the user.