Backdoor.Win32.Delf.ugd

Technical Details
Payload
Removal instructions

Technical Details

This Trojan provides a malicious user with remote access to the infected computer. It is a Windows application (PE EXE file). It is 365 568 bytes in size. It is written in Delphi.

Installation

Once launched, the Trojan extracts the following files from its body to the system directory:

%System%\kboem32.datbytes
%System%\crt4.dllbytes, detected by Kaspersky Anti-Virus as Backdoor.Win32.Delf.ugd
%System%\kbdatat4.dllbytes
%System%\kbddta.dllbytes, detected by Kaspersky Anti-Virus as Trojan.Win32.Delf.wtp
%System%\kbsnd32.dllbytes, detected by Kaspersky Anti-Virus as Trojan.Win32.Delf.wtr
%System%\kbupdate.dllbytes, detected by Kaspersky Anti-Virus as Trojan.Win32.Delf.wto

The malware then launches the following file for execution:

%System%\svchost.exe

and injects the malicious functionality of the following library into that process's address space:

%System%\crt4.dll

For its malicious library "kbupdate.dll" to launch automatically each time the system is rebooted and also upon exiting the system, the Trojan creates the following key in the system registry:

[HKLM\Software\Microsoft\Windows NT\CurrentVersion\
Winlogon\Notify\kbupdate]
"DllName" = "kbupdate.dll"
"Startup" = "WinlogonStartupEvent"
"Logoff" = "WinlogonLogoffEvent"
"Shutdown" = "WinlogonLogoffEvent"
"Asynchronous" = 0x00000001
"Impersonate" = 0x00000000

Payload

The malicious program contains a built-in keylogger which saves the keylog in the encrypted file:

%System%\kboem32.dat

It launches a hidden HTTP proxy server on a random TCP port on the user's computer.

It contains a built-in Gnutella P2P protocol client, by means of which it enters this peer-to-peer network and can download files from here to the user's computer, saving them under different names in the %System% folder. The backdoor also enables the malicious users to download files chosen by them from the infected computer via the P2P network.

The backdoor establishes a connection with the following address:

89.149.***.46:8014

from which it receives a script in an encrypted form, which determines the backdoor's subsequent actions in the system.

Removal instructions

If your computer does not have an antivirus, and is infected by this malicious program, follow the instructions below to delete it:

1. Delete the original Trojan file (its location will depend on how the program originally penetrated the infected computer).

2. Delete the following system registry key:

   [HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\kbupdate]
   Delete the following files:
   %System%\kboem32.dat
   %System%\crt4.dl 
   %System%\kbdatat4.dll
   %System%\kbddta.dll
   %System%\kbsnd32.dll
   %System%\kbupdate.dll
   

3. Perform a full scan of the computer using Kaspersky Anti-Virus with up-to-date antivirus databases (download a trial version).