BKDR_CRIDEX.MQ

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It is injected into all running processes to remain memory resident.

It executes commands from a remote malicious user, effectively compromising the affected system. However, as of this writing, the said sites are inaccessible.

It deletes the initially executed copy of itself.

Arrival Details

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This backdoor drops the following copies of itself into the affected system:

• %Application Data%\KB{random number}.exe

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.)

It drops the following non-malicious file:

• %Application Data%\{random folder}\{random}

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.)

It creates the following folders:

• %Application Data%\{random folder}

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.)

It is injected into all running processes to remain memory resident.

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• Local\XME{random 8-character}
• Local\XMM{random 8-character}
• Local\XMI{random 8-character}
• Local\XMS{random 8-character}
• Local\XMF{random 8-character}
• Local\XMR{random 8-character}
• Local\XMQ{random 8-character}
• Local\XMB{random 8-character}

Autostart Technique

This backdoor adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
KB{random number}.exe = "%Application Data%\KB{random number}.exe"

Other System Modifications

This backdoor adds the following registry keys:

HKEY_CURRENT_USER\Software\Microsoft\
Windows NT\{random}

HKEY_CURRENT_USER\Software\Microsoft\
Windows NT\{random 1}

It adds the following registry entries:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings
GlobalUserOffline = "0"

Backdoor Routine

This backdoor executes the following commands from a remote malicious user:

• Download and execute additional files
• Download other files
• Monitors cookies
• Steal login credentials
• Update itself
• Upload collected certificates and credentials

It connects to the following URL(s) to send and receive commands from a remote malicious user:

• http://{BLOCKED}srvr8.ru/jsbqmCA/hCpyb/Cnw/ED/
• http://{BLOCKED}load.ru/jsbqmCA/hCpyb/Cnw/ED/
• http://{BLOCKED}sdnl.ru/jsbqmCA/hCpyb/Cnw/ED/
• http://{BLOCKED}ownloads17.ru/jsbqmCA/hCpyb/Cnw/ED/

However, as of this writing, the said sites are inaccessible.

Information Theft

This backdoor monitors the Internet Explorer (IE) activities of the affected system, specifically the address bar. It recreates a legitimate website with a spoofed login page if a user visits banking sites with the following strings in the address bar and/or title bar:

• /ach/
• /authentication/zbf/k/
• /bb/logon/
• /cashman/
• /cashplus/
• /clkccm/
• /cmmain\.cfm
• /cmserver/
• /cmwire
• /ebc_ebc1961/
• /ibs\.
• /ibws/
• /icm/
• /icm2/
• /inets/
• /livewire/
• /loginolb/loginolb
• /netbnx/
• /olbb/
• /phcp
• /sbuser/
• /smallbiz/
• /wcmpw/
• /webcm/
• /wire/
• /wires/
• 2checkout\.com
• \.com/k1/
• aah-point\.com
• ablv\.com
• abnamro\.nl
• access\.jpmorgan\.com
• access\.usbank\.com
• accessbankplc\.com
• accountoverview\.aspx
• accurint\.com
• achieveaccess\.citizensbank\.com
• achpayment
• achredirect\.aspx
• achweb\.unionbank\.com
• achworks\.com
• alltimetreasury\.pacificcapitalbank\.com
• alphabank\.com
• amegybank\.com/
• anb\.portalvault\.com
• anz\.com
• arizonastatecu\.org/onlineserv/HB/
• atbonlinebusiness\.com
• auth\.umb\.com
• authmaster\.nationalcity\.com
• baltikums\.com
• baltikums\.eu
• banesco\.com\.pa
• bankbyweb
• bankfirst\.com
• banking\.calbanktrust\.com
• banking\.firsttennessee\.biz
• banknet\.lv
• bankofbermuda\.com
• bankofcyprus\.com
• bankofthewest\.com
• bankonline\.sboff\.com
• bcu\.org
• business\.swedbank\.lv
• cbonline
• cencorpcu\.com/
• chase\.com
• etrade\.com
• ezremitlive\.net
• fairmontfcu\.com
• financialtrans\.com
• firstcitizens\.org
• garanti\.com\.tr
• gcfcu\.org
• hbstech
• hsabank\.com
• ing\.nl
• inovafcu\.org
• instantcashworldwide
• itransfer\.com
• jdcu\.com
• jubaxpress
• key\.com
• keysfcu\.org
• kstcu\.org
• louisianafcu\.org
• memberdirect\.net/brand/ab_communitysavings/OnlineBanking/Accounts/
• muthootglobal
• mwafcu\.org
• myebanking\.net
• myfireonline\.org
• myonline\.bankbv\.com
• myunited\.ca
• nab\.com\.au
• nbad\.com
• nbtacu\.nb\.ca
• newwaterfordcreditunion\.com
• nlcu\.com
• nlcu\.on\.ca
• northerncu\.com
• northridgesavings\.com
• northsave\.com
• northsydneycreditunion\.com
• o2\.oximall\.com
• online\.ent\.com
• onlineserv/HB
• oppacu\.com
• oswfs\.com
• pboccu\.com
• penfinancial\.com
• peoplescu\.ca
• plainscapital\.gfxwebwire\.com
• postfinance\.ch
• progressivecu\.nb\.ca
• prospera\.ca
• provincehouse\.com
• pscu\.ca
• rabobank\.nl
• rbcroyalbank\.com/accounts
• rbsm\.com
• rcu\.com
• redcanoecu\.com
• reddyk\.net
• rjf\.com
• royalexchange
• sascu\.com
• sccu\.ca
• secure\.accesshorizon\.com
• secuwa\.org
• servlet/Teller
• snsbank\.nl
• souriscreditu\.com
• southwestcu\.com
• stellamariscreditu\.com
• sterlingpayment\.com
• stjosephscreditu\.ca
• sudburycu\.com
• sydneycreditunion\.com
• tcufinancialgroup\.com
• teacherscu\.on\.ca
• teacherspcu\.ca
• tignishcreditu\.com
• tpcu\.on\.ca
• transfastwmt
• txn\.banking\.pcfinancial\.ca
• unigasco\.com
• unitysavings\.com
• unwfcu\.org
• usaa\.com
• valleycreditunion\.com
• valleyfirstcu\.org
• vancity\.com
• vantageone\.net
• venturecu\.ca
• victorycreditunion\.ca
• wfcu\.ca
• wpcuonline\.net
• wscu\.com
• wu-amar\.com
• www.sydenhamccu\.ca
• xpressmoney
• yourcu\.com

Other Details

This backdoor deletes the initially executed copy of itself

NOTES:

It collects configuration data and store it in the registry:

HKEY_CURRENT_USER\Software\Microsoft\Windows NT\{random 1} {default} = "{config file}"

It monitors the following browsers:

• chrome.exe
• explorer.exe
• firefox.exe