BKDR_TENGO.A

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes commands from a remote malicious user, effectively compromising the affected system. It connects to a website to send and receive information.

Arrival Details

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This backdoor drops the following files:

• %WINDOWS%\$NtUninstallKB080515$\Usblog_DXM.log

It creates the following folders:

• %WINDOWS%\$NtUninstallKB080515$

Other System Modifications

This backdoor deletes the following files:

• {Malware Path}\msvidc161.dll
• %System%\winmm16.dll

(Note: %System% is the Windows system folder, which is usually C:\Windows\System32.)

It adds the following registry entries:

HKEY_CLASSES_ROOT\exefile
NeverShowExt = "0"

It modifies the following registry entries:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
Hidden = "0"

(Note: The default value data of the said registry entry is 1.)

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
HideFileExt = "1"

(Note: The default value data of the said registry entry is 0.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced\Folder\Hidden\
SHOWALL
CheckValue = "0"

(Note: The default value data of the said registry entry is 1.)

Backdoor Routine

This backdoor executes the following commands from a remote malicious user:

• Get Malware Information
• Update Itself
• Update C&C servers/IP Information
• Perform sleep command
• File Manipulation (View added files, Rename, Delete, Check filetype, Modify, Change attiributes, Change filetime, Copy)
• Directory Manipulation (Change Current, Add, View directories)
• Reboot and Disconnect
• Perform shell command
• View System Informations (Mac Address, Computer Name, Wan/Local IP, Disk Information, Display Mode, CPU Information, Path of System Directory, OS Inofrmation, Drive Information, Malware Uptime)
• Load other modules
• Execute a program (with option as Administrator)
• List IPs
• List/Disconnect TCP Connections
• List/Kill Processes
• Download File
• Upload File
• Enumerate/Install Services
• Load keylogging module (mskb32.dll)

It connects to the following websites to send and receive information:

• {BLOCKED}.{BLOCKED}.204.62
• {BLOCKED}.{BLOCKED}.102.244
• {BLOCKED}.{BLOCKED}.103.42
• {BLOCKED}.{BLOCKED}.10.239
• {BLOCKED}.{BLOCKED}.145.118
• {BLOCKED}i89.{BLOCKED}s.info
• http://{BLOCKED}02.{BLOCKED}z.info/dxj

NOTES:

It renames the file %System%\winmm.dll to %System%\winmm16.dll. It then drops a copy of itself as %System%\winmm.dll.

It renames the file %System%\winmm.DLL to %System%\winmm16.DLL then drops a copy of itself as %System%\winmm.DLL.

This backdoor copies files with the following format below from removable drives connected through the machine:

• .doc
• .pdf
• .tif
• .xls
• .ppt

This will be saved in the folder %SystemRoot%\$NtUninstallKB080515$, which can be retrieved later via remote commands.