PE_BUZUS.A-O

This file infector arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It infects certain file types by inserting code in the said files.

It executes commands from a remote malicious user, effectively compromising the affected system.

It deletes the initially executed copy of itself.

Arrival Details

This file infector arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This file infector drops the following copies of itself into the affected system and executes them:

• %System%\{random filename 1}.exe
• %System%\{random filename 2}.exe

(Note: %System% is the Windows system folder, which is usually C:\Windows\System32.)

It drops the following non-malicious files:

• %System%\{random filename 3}.nls
• %System%\{random filename 4}.nls
• %System%\c_l{random 4-digit number}.nls
• %System%\_Setup.bat (deleted afterwards)
• %System%\_DELETEME.BAT (deleted afterwards)

(Note: %System% is the Windows system folder, which is usually C:\Windows\System32.)

Autostart Technique

This file infector adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Active Setup\Installed Components\{GUID}
StubPath = "%System%\cmd.exe /c %System%\{random filename 1}.exe /i"

Other System Modifications

This file infector adds the following registry keys:

HKEY_CURRENT_USER\Software\Foxy

HKEY_CURRENT_USER\Software\Foxy\
path

HKEY_CURRENT_USER\Software\Foxy\
path\karaoke

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Active Setup\Installed Components\{GUID}

File Infection

This file infector searches for target files in the following drives:

• remote drives
• removable drives

It infects files with the following file extensions by inserting code in the said files:

• .exe

Backdoor Routine

This file infector executes the following commands from a remote malicious user:

• update itself
• terminate processes
• delete files
• download and execute arbitrary files

It connects to the following URL(s) to send and receive commands from a remote malicious user:

• http://{BLOCKED}f5.{BLOCKED}ine.nu/config.asp?id={root directory serial number}
• http://{BLOCKED}ra6.{BLOCKED}omeftp.org/config.asp?id={root directory serial number}
• http://{BLOCKED}b1.{BLOCKED}erveftp.net/config.asp?id={root directory serial number}
• http://{BLOCKED}er5.{BLOCKED}melinux.com/config.asp?id={root directory serial number}
• http://{BLOCKED}ra8.{BLOCKED}meip.net/config.asp?id={root directory serial number}
• http://{BLOCKED}sg14.{BLOCKED}meunix.net/config.asp?id={root directory serial number}
• http://{BLOCKED}bc23.{BLOCKED}medns.org/config.asp?id={root directory serial number}
• http://{BLOCKED}i88.{BLOCKED}ndns.org/config.asp?id={root directory serial number}
• http://{BLOCKED}bh1.{BLOCKED}ndns.info/config.asp?id={root directory serial number}
• http://{BLOCKED}55.{BLOCKED}me-host.org/config.asp?id={root directory serial number}

As of this writing, the said sites are inaccessible.

Information Theft

This file infector gathers the following data:

• Root directory serial number - used as id when connecting to C&C servers

Other Details

This file infector deletes the initially executed copy of itself

NOTES:

It will list all the file names (base names) of all .DLL files inside the %System% folder that don't have an equivalent .EXE, .NLS or .CPL files. From this list, it will randomly select the file names it will use for the dropped copies and non-malicious components in the %System% folder.

It does not have rootkit capabilities.

It does not exploit any vulnerability.