BackDoor.Xdoor.378

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '54rk' = ''

Malicious functions:

Creates and executes the following:

<SYSTEM32>\Tencentl00.exe
%TEMP%\DNFАЗИє_2013_4_9(B).exe
%TEMP%\svchost.exe

Executes the following:

<SYSTEM32>\svchost.exe
<SYSTEM32>\ping.exe 127.0.0.1 -n 2
<SYSTEM32>\cmd.exe /c restart.bat

Modifies file system :

Creates the following files:

%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\CAAVOBS3
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\CAJI2WQU
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\CAQT8D61
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\CAFIAV9M
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\CAD3O2B6
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[97]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[96]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[98]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\CAWXUV41
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[99]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\CAAX2HIX
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\CAQV81U3
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\CA48ZMHE
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\CAWTPOWH
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\CA8YRL92
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\CARAHVOK
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\CA21ST4V
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\CAL75WPY
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\CA48IWNG
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\CA2J8DMZ
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[95]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[81]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[80]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[82]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[84]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[83]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[76]
<Current directory>\restart.bat
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[77]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[79]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[78]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[91]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[90]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[92]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[94]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[93]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[86]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[85]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[87]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[89]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[88]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\CAQO6E1B
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\CAYMRCS6
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\CAW1ER8D
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\CAKFERA3
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\CAMEJHFX
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\CAELS3YH
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\CA3IQCXK
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\CAMNWXUF
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\CA7XPQ16
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\CA20J3S1
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\CAUL4LWN
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\CALBWESO
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\CAOX2R05
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\CA0DQFGD
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\CA2BP9EY
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\CAQNRK1G
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\CAGDIR0N
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\CAEFWD63
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\CAPXWAAF
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\CAZ7NS4I
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\CA2BOFAH
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\CA1O0FFD
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\CARCV6VS
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\CAMFGDEB
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\CAUN4HQB
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\CASN4VMX
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\CABBCWGM
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\CACOR8B0
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\CAORIRYT
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\CAODWT81
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\CAQJGXMF
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\CA84QWYE
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\CA8H4VMB
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\CA0P56FI
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\CAIFW5MN
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\CAWNW9UP
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\CADZF6MX
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\CA39WYPM
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\CACFGD48
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\CAC9KZ89
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\CA07CVCH
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[75]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[20]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[19]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[21]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[23]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[22]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[15]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[14]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[16]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[18]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[17]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[30]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[29]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[31]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[33]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[32]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[25]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[24]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[26]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[28]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[27]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[13]
%TEMP%\langqunDDK.sys
%TEMP%\SkinH_EL.dll
%TEMP%\Demo.dll
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[2]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[1]
%TEMP%\DNFАЗИє_2013_4_9(B).exe
%TEMP%\svchost.exe
<SYSTEM32>\cfghw.tmp
<DRIVERS>\kiss.she
<SYSTEM32>\Tencentl00.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[9]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[8]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[10]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[12]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[11]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[4]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[3]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[5]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[7]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[6]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[61]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[60]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[62]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[64]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[63]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[56]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[55]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[57]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[59]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[58]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[71]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[70]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[72]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[74]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[73]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[66]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[65]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[67]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[69]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[68]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[54]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[40]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[39]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[41]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[43]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[42]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[35]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[34]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[36]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[38]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[37]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[50]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[49]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[51]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[53]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[52]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[45]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[44]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[46]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[48]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[47]

Modifies the HOSTS file.

Network activity:

Connects to:

'localhost':1043
'ge##.zgpmsj.com':3721
'www.ip##8.com':80
'localhost':1041
'localhost':1035
'localhost':1037
'12#.#2.170.123':661

TCP:

HTTP GET requests:

www.ip##8.com/

UDP:

DNS ASK www.ip##8.com
DNS ASK xi#####o.dnflangqun.com
DNS ASK www.ba##u.com
DNS ASK ok#.#aonmb.com
DNS ASK www.ta###zhe.com
DNS ASK ge##.zgpmsj.com

Miscellaneous:

Searches for the following windows:

ClassName: 'MS_WebcheckMonitor' WindowName: ''
ClassName: 'MS_AutodialMonitor' WindowName: ''
ClassName: 'Shell_TrayWnd' WindowName: ''

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial