Backdoor.Win32.Delf.aow

Technical Details

This malicious program provides a remote user with access to the victim machine. It is a Windows PE EXE file. It is approximately 200KB in size. It is packed using UPX. The unpacked file is approximately 518KB in size. It is written in Borland Delphi.

Installation

Once launched, the backdoor checks to see if the name of its file coincides with the following string:

If this is not the case, the backdoor will check if the file is a copy of a malicious program located in the Windows system directory in a file called "spoolsn.exe":

If there is no file called "spoolsn.exe" present on the system, the backdoor checks for a file called "klick.sys" in the "drivers" subfolder of the Windows system directory:

If this file is present on the system, a batch file called "batset.bat" will be created in the Windows system directory and launched for execution:

This file is 87 bytes in size, and will be detected by Kaspersky Anti-Virus as Trojan.BAT.KillAV.ec

The backdoor then creates a copy of its body in the "spoolsn.exe" file in the Windows system directory:

and ascribes "hidden" and "system" attributes to this file.

The backdoor uses Services Management to delete the service with the following name:

After a one second pause, it will register a copy of the malicious file as a system service which will run automatically. The name of the service is as follows:

The name that will be displayed is as follows:

And the description is as follows:

The copy of the malicious file will then be launched:

A batch file called "Deleteme.bat" will also be created and launched in the Windows system directory. This file will delete both itself and the original copy of the malicious program.

The copy of the malicious program will then cease running.

Payload

The backdoor provides a remote malicious user with the ability to manage the victim machine by establishing a TCP connection to port 8820 on a remote server called "asw412.3***.org":

The remote malicious user will then be able to:

1. get information about the victim machine including: computer name; list of network connections; type of operating system; processing power; amount of RAM This data is saved to a log-file called "DDOSBZ.TXT" in the Windows system directory:
   %System%\DDOSBZ.TXT
2. delete the malicious program from the system;
3. log off, shut down or reboot the infected system;
4. use the victim machine as a proxy serve;
5. conduct a variety of DDoS attacks;
6. download and save files to the Windows system directory under randomly generated names, and then launch these files;
7. set the Internet Explorer home page;
8. set various security policies;
9. autorun malicious programs.

It is possible to determine if a copy of the malicious program is running by the presence of a process called "spoolsn.exe" in the list of processes; this is a hidden copy of Internet Explorer ("iexplore.exe").

The backdoor also disables the autorunning of files on logical disks by setting the following system registry parameter value:

It then creates copies of the malicious file, called "spoolsn.exe" in the root directories of all logical disks:

It also creates files called "AutoRun.inf" which are 29 bytes in size, and which will autorun the copies of the malicious file.

Removal instructions

If your computer does not have an up-to-date antivirus, or does not have an antivirus solution at all, follow the instructions below to delete the malicious program:

1. Delete files called "AutoRun.inf" from the root directories of all logical disks.
2. Use Task Manager to terminate the original Trojan process and the processes listed below:
   spoolsn.exe
   iexplore.exe
3. Delete the original malicious file (its location will depend on how the program originally penetrated the victim machine). Delete all files called "spoolsn.exe" from the Windows system directory and from the root directories of all logical disks:
   %System%\spoolsn.exe
   .\spoolsn.exe
4. Delete the following system registrykey:
   [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Windows_Serve]
5. Delete the following files:
   %System%\Deleteme.bat
   %System%\batset.bat
6. Update your antivirus databases and perform a full scan of the computer (download a trial version of Kaspersky Anti-Virus).

Summary

• Implements network activity

• Performs potentially dangerous activity

Technical details

File size of 206336 bytes.

Installation

Makes copies of itself with the following names once launched:

• Windows system directory (usually, C:\Windows\System32) %System%\expl0rer.exe

Creates the following files on an infected computer:

• Windows system directory (usually, C:\Windows\System32) %System%\Deleteme.bat

Ensures Using the system registry, system services or special system files, the program can launch itself or launch the creation of its files every time the Windows OS is subsequently booted autorun of the following installed files:

using system services:

Service name:	Windows d_server
Displayed service name:	Windows_ServerDdos
Startup parameters	Windows system directory (usually, C:\Windows\System32) %System%\expl0rer.exe
Startup type:	­automatic­

Malicious activity

Connects to to the following Internet addresses:

• ***ervice.3322.org:20480

Other activities

Runs the following files (commands):

• Windows system directory (usually, C:\Windows\System32) %System%\expl0rer.exe (­implements multiple launch­)

Deletes the following files on an infected computer:

• <­path to source program­><­file of source program ­>