live casino online

BKDR_ZACESS.SMQQ

October 27, 2012
 Analysis by: Rhena Inocencio
 PLATFORM:

Windows 2000, Windows XP, Windows Server 2003

 OVERALL RISK RATING:
 DAMAGE POTENTIAL:
 DISTRIBUTION POTENTIAL:
 REPORTED INFECTION:

  • Threat Type: Backdoor

  • Destructiveness: No

  • Encrypted: Yes

  • In the wild: Yes

  OVERVIEW

Infection Channel:

Dropped by other malware, Downloaded from the Internet

This backdoor terminates processes which can compromise system security. It also patches a file that subsequently becomes malicious.

This backdoor arrives via peer-to-peer (P2P) shares. It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. It may be dropped by other malware.

It connects to a website to send and receive information.

  TECHNICAL DETAILS

File Size:

192,512 bytes

File Type:

DLL

Memory Resident:

Yes

Initial Samples Received Date:

06 Jul 2012

Payload:

Connects to URLs/IPs, Terminates processes, Patches files

Arrival Details

This backdoor arrives via peer-to-peer (P2P) shares.

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It may be dropped by the following malware:

  • BKDR_ZACCESS.KP

Autostart Technique

This backdoor adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}\
InprocServer32
ThreadingModel = "Both"

HKEY_CURRENT_USER\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}\
InprocServer32
(Default) = "%Application Data%\{GUID}\n."

Other System Modifications

This backdoor modifies the following registry entries:

HKEY_CLASSES_ROOT\CLSID\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\
InprocServer32
(Default) = "\.\globalroot\systemroot\Installer\{GUID}\n."

(Note: The default value data of the said registry entry is %System%\wbem\wbemess.dll.)

Backdoor Routine

This backdoor connects to the following websites to send and receive information:

  • http://{BLOCKED}s.{BLOCKED}g.com

Process Termination

This backdoor terminates the following processes if found running in the affected system's memory:

  • MsMpSvc
  • windefend
  • SharedAccess
  • iphlpsvc
  • wscsvc
  • mpssvc
  • bfe
  • SecurityCenter
  • Wscnotify.exe
  • MSASCui.exe
  • MpCmdRun.exe
  • MisSrv.exe
  • msseces.exe
  • wsctfy.exe

Other Details

This backdoor requires the existence of the following files to properly run:

  • %User Temp%\InstallFlashPlayer.exe

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003.)

NOTES:

It connects to its C&C server using UDP connection.

It is a .DLL file, which is executed by %User Temp%\InstallFlashPlayer.exe.

It patches %System%\services.exe and saves the original copy in %System%\Winsxs\Backup\services.exe.

  • Patched 64-bit %System%\services.exe - detected as PTCH64_ZACCESS.A
  • Patched Win7 32-bit %System%\services.exe - detected as PTCH_ZACCESS.A

The modified registry ensures that the malware is loaded instead of %System%\wbem\wbemess.dll, which is related to Web Browser Control.

The following files, which are dropped by the main malware BKDR_ZACCESS.KP, are used by BKDR_ZACESS.SMQQ in registry entries to enable automatic execution of the malware at every system startup:

  • %Application Data%\{GUID}\n.
  • \.\globalroot\systemroot\Installer\{GUID}\n.

where \.\globalroot\systemroot is equivalent to %Windows%

  SOLUTION

Minimum Scan Engine:

9.200

FIRST VSAPI PATTERN FILE:

9.240.07

FIRST VSAPI PATTERN DATE:

06 Jul 2012

VSAPI OPR PATTERN File:

9.241.00

VSAPI OPR PATTERN Date:

06 Jul 2012

Step 1

For Windows XP and Windows Server 2003 users, before doing any scans, please make sure you to allow full scanning of your computer.

Step 2

Remove malware files dropped/downloaded by BKDR_ZACESS.SMQQ

Step 3

Remove the malware/grayware file that dropped/downloaded BKDR_ZACESS.SMQQ