live casino online

BKDR_SIMBOT.AX

October 09, 2012
 Analysis by: Jasen Sumalapao
 ALIASES:

Backdoor:Win32/Simbot (Microsoft), DeepScan:Generic.Malware.SVdld!.7C8060FE (FSecure), DeepScan:Generic.Malware.SVdld!.7C8060FE (Bitdefender)

 PLATFORM:

Windows 2000, Windows XP, Windows Server 2003

 OVERALL RISK RATING:
 DAMAGE POTENTIAL:
 DISTRIBUTION POTENTIAL:
 REPORTED INFECTION:

  • Threat Type: Backdoor

  • Destructiveness: No

  • Encrypted: No

  • In the wild: Yes

  OVERVIEW

Infection Channel:

Downloaded from the Internet, Dropped by other malware

This backdoor may be downloaded by other malware/grayware/spyware from remote sites. It may be dropped by other malware.

It executes the dropped file(s). As a result, malicious routines of the dropped files are exhibited on the affected system.

As of this writing, the said sites are inaccessible.

  TECHNICAL DETAILS

File Size:

12,800 bytes

File Type:

EXE, DLL

Memory Resident:

Yes

Initial Samples Received Date:

23 Aug 2012

Payload:

Connects to URLs/IPs, Drops files, Downloads files

Arrival Details

This backdoor may be downloaded by other malware/grayware/spyware from remote sites.

It may be dropped by the following malware:

  • TROJ_ARTIEF.AX

Installation

This backdoor drops the following component file(s):

  • %User Profile%\ntuser.cfg - detected as BKDR_SIMBOT.AX

(Note: %User Profile% is the current user's profile folder, which is usually C:\Windows\Profiles\{user name} on Windows 98 and ME, C:\WINNT\Profiles\{user name} on Windows NT, and C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003.)

It adds the following mutexes to ensure that only one of its copies runs at any one time:

  • NTUserCfg
  • efcc ilitat

Autostart Technique

This backdoor adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTUCF = "rundll32 %User Profile%\ntuser.cfg,Config"

Backdoor Routine

This backdoor connects to the following URL(s) to send and receive commands from a remote malicious user:

  • {BLOCKED}.{BLOCKED}.247.57:80

Dropping Routine

This backdoor executes the dropped file(s). As a result, malicious routines of the dropped files are exhibited on the affected system.

Download Routine

This backdoor connects to the following website(s) to download and execute a malicious file:

  • http://ssl.{BLOCKED}3.org/images/dw.html
  • http://ssl.{BLOCKED}3.org/images/fc.asp
  • http://ssl.{BLOCKED}3.org/images/pma.pdf

As of this writing, the said sites are inaccessible.

  SOLUTION

Minimum Scan Engine:

9.200

FIRST VSAPI PATTERN FILE:

9.346.01

FIRST VSAPI PATTERN DATE:

24 Aug 2012

VSAPI OPR PATTERN File:

9.347.00

VSAPI OPR PATTERN Date:

25 Aug 2012

Step 1

For Windows XP and Windows Server 2003 users, before doing any scans, please make sure you to allow full scanning of your computer.

Step 2

Remove malware/grayware files that dropped/downloaded BKDR_SIMBOT.AX