BackDoor.Siggen.48143

Added to the Dr.Web virus database: 2012-10-03

Virus description added: 2012-10-18

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'wextract_cleanup0' = 'rundll32.exe <SYSTEM32>\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP000.TMP\"'

Creates or modifies the following files:

%WINDIR%\Tasks\At4.job
%WINDIR%\Tasks\At5.job
%WINDIR%\Tasks\At6.job
%WINDIR%\Tasks\At1.job
%WINDIR%\Tasks\At2.job
%WINDIR%\Tasks\At3.job

Creates the following services:

[<HKLM>\SYSTEM\ControlSet001\Services\DNSSystem] 'Start' = '00000002'
[<HKLM>\SYSTEM\ControlSet001\Services\System32] 'Start' = '00000002'
[<HKLM>\SYSTEM\ControlSet001\Services\Schedule] 'Start' = '00000002'

Infects the following executable system files:

<SYSTEM32>\sc.exe

Substitutes the following executable system files:

<SYSTEM32>\dllcache\sc.exe with <SYSTEM32>\dllcache\sc.exe.new
<SYSTEM32>\sc.exe with <SYSTEM32>\sc.exe.new

Malicious functions:

Creates and executes the following:

<SYSTEM32>\sc.exe create DNSSystem binpath= "%WINDIR%/system32\SVCH0ST.exe /c start SuCH0ST.exe " start= auto
<SYSTEM32>\systeml.exe /service
<SYSTEM32>\sc.exe config DNSSystem displayname= "System DNS"
<SYSTEM32>\sc.exe description DNSSystem "(C) Microsoft Corporation ╣л╦╛╠с╣й╡─(DNS)╙Є├√╜т╬Ў│╠╨Є,╚ч╣√╕├╖■╬ё▒╗═г╙├гм╚╬║╬╥└└╡╦№╡─╖■╬ё╜л╬▐╖и╞Ї╢пбг"
<SYSTEM32>\sc.exe config DNSSystem type= interact type= own
<SYSTEM32>\sc.exe start System32
<SYSTEM32>\sc.exe create System32 binpath= "<SYSTEM32>\systeml.exe /service" start= auto
%TEMP%\IXP000.TMP\BOOT(~1.EXE
<SYSTEM32>\sc.exe config System32 displayname= "System services"
<SYSTEM32>\sc.exe description System32 "╥└└╡╧╡═│╖■╬ё(QoS)╡─┐╪╓╞╙ж╙├│╠╨Є,╚ч╣√╕├╖■╬ё▒╗═г╙├гм╚╬║╬╥└└╡╦№╡─╖■╬ё╜л╬▐╖и╞Ї╢пбг"
<SYSTEM32>\sc.exe config System32 type= interact type= own

Executes the following:

<SYSTEM32>\at.exe 12:00 cmd /c start <SYSTEM32>\ATT.vbs 1
<SYSTEM32>\at.exe /del /y
<SYSTEM32>\at.exe 13:00 cmd /c start <SYSTEM32>\ATT.vbs 2
<SYSTEM32>\at.exe 22:00 cmd /c start <SYSTEM32>\ATT.vbs 4
<SYSTEM32>\at.exe 20:00 cmd /c start <SYSTEM32>\ATT.vbs 3
<SYSTEM32>\ping.exe www.qq.com -n 2
%WINDIR%\regedit.exe /s 360.reg
<SYSTEM32>\find.exe "Reply from"
<SYSTEM32>\wscript.exe "<SYSTEM32>\mail3.vbe"
<SYSTEM32>\ipconfig.exe /all
<SYSTEM32>\attrib.exe system2.bat +s +h
<SYSTEM32>\attrib.exe systeml.exe +s +h
<SYSTEM32>\attrib.exe WindowsUpdate.vbs +s +h
<SYSTEM32>\attrib.exe ATT.vbs +s +h
<SYSTEM32>\attrib.exe ATT.bat +s +h
<SYSTEM32>\at.exe 01:00 cmd /c start <SYSTEM32>\ATT.vbs 6
<SYSTEM32>\at.exe 23:00 cmd /c start <SYSTEM32>\ATT.vbs 5
<SYSTEM32>\attrib.exe mail3.vbe +s +h
<SYSTEM32>\attrib.exe radmin.reg +s +h
<SYSTEM32>\attrib.exe sc.exe +s +h
<SYSTEM32>\taskkill.exe /f /im KVwsc.exe
<SYSTEM32>\net1.exe start schedule
<SYSTEM32>\sc.exe config schedule start= auto
<SYSTEM32>\taskkill.exe /f /im 360tray.exe
<SYSTEM32>\taskkill.exe /f /im 360safebox.exe
<SYSTEM32>\taskkill.exe /f /im 360safe.exe
%WINDIR%\regedit.exe /s radmin.reg
<SYSTEM32>\wscript.exe "<SYSTEM32>\WindowsUpdate.vbs"
<SYSTEM32>\cmd.exe /c ""<SYSTEM32>\system2.bat" "
<SYSTEM32>\net1.exe stop sharedaccess
<SYSTEM32>\net.exe stop sharedaccess
<SYSTEM32>\taskkill.exe /f /im KAVsvcUI.exe
<SYSTEM32>\taskkill.exe /f /im KAVsvc.exe
<SYSTEM32>\taskkill.exe /f /im KVFW.EXE
<SYSTEM32>\taskkill.exe /f /im KVMonXP.exe
<SYSTEM32>\taskkill.exe /f /im KVsrvXP.exe
<SYSTEM32>\taskkill.exe /f /im Navapw32.exe
<SYSTEM32>\taskkill.exe /f /im safeboxtray.exe
<SYSTEM32>\taskkill.exe /f /im Navapsvc.exe
<SYSTEM32>\taskkill.exe /f /im Iparmor.exe
<SYSTEM32>\taskkill.exe /f /im PFW.exe

Terminates or attempts to terminate

the following user processes:

NAVAPW32.EXE
360tray.exe

Modifies file system :

Creates the following files:

<SYSTEM32>\systeml.exe
<SYSTEM32>\system2.bat
<SYSTEM32>\radmin.reg
<SYSTEM32>\WindowsUpdate.vbs
<SYSTEM32>\SVCH0ST.exe
<SYSTEM32>\mailbody.txt
<SYSTEM32>\360.reg
<SYSTEM32>\SuCH0ST.exe
<SYSTEM32>\AdmDll.dll
%TEMP%\IXP000.TMP\BOOT(~1.EXE
<SYSTEM32>\raddrv.dll
<SYSTEM32>\mail3.vbe
<SYSTEM32>\ATT.vbs
<SYSTEM32>\ATT.bat

Sets the 'hidden' attribute to the following files:

<SYSTEM32>\WindowsUpdate.vbs
<SYSTEM32>\system2.bat
<SYSTEM32>\ATT.vbs
<SYSTEM32>\ATT.bat
<SYSTEM32>\sc.exe
<SYSTEM32>\mail3.vbe
<SYSTEM32>\systeml.exe
<SYSTEM32>\radmin.reg

Deletes the following files:

<SYSTEM32>\360.reg
%TEMP%\IXP000.TMP\BOOT(~1.EXE

Network activity:

Connects to:

'sm##.tom.com':25

UDP:

DNS ASK sm##.tom.com
DNS ASK www.qq.com

Miscellaneous:

Searches for the following windows:

ClassName: 'RegEdit_RegEdit' WindowName: ''
ClassName: '' WindowName: ''
ClassName: 'EDIT' WindowName: ''
ClassName: 'Shell_TrayWnd' WindowName: ''

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical Information

Recommandations pour le traitement

Free trial