マイライブラリ
マイライブラリ

+ マイライブラリに追加

電話

お問い合わせ履歴

電話(英語)

+7 (495) 789-45-86

Profile

BackDoor.Bulknet.739

Added to the Dr.Web virus database: 2012-09-20

Virus description added:

The execution of the malicious code triggers a module that decrypts the Trojan's body. The module then loads code segments into the memory, configures import routines and transfers control to the entry point.

screen

Then another module loads an image into the memory of the compromised machine.

Downloader

The Trojan downloader copies itself as %USER%\<rnd>.exe, and adds itself to the startup list:

software\microsoft\windows\currentversion\run <rnd>=%USER%\<rnd>.exe

It uses RSA keys to encrypt its traffic.

IAfter that a query encrypted with a public key is sent to a server:

screen

It decrypts the reply with a private key:

screen

The downloader incorporates a hardcoded list of domain names, some of which are encrypted too. It sends GET queries to domains on the list. In response, the Trojan obtains the main web page and parses the HTML code in search of the image tag <img src="data:image/jpeg;base64 … >.

It decodes tag arguments into a malicious file (upon a command or starts the process svchost.exe) and tries to inject the file code into the process, or saves it into a temporary folder.

Then it extracts a list of addresses and the module BackDoor.Bulknet.739 (DDoS) from its body and loads the module into the memory.

It sends an HTTP request to a server on the list, downloads a page and parses its HTML code in search of the image tag <img src="data:image/jpeg;base64 … >. It decrypts the tag arguments into a file disguised as a JPEG image. This file contains the data container, compressed with gzip. BackDoor.Bulknet.739 is decrypted from the compressed data.

Downloader routine

The downloader sends data in encrypted form. The encryption routine is as follows: 

int crypt_send_data(DWORD *data, signed int size, int key1)
{
  int count; // ecx@1
  int key; // edi@4
  int n; // eax@4
  int size_add; // ebx@7
  DWORD *v7; // esi@8
  int v9; // [sp+4h] [bp-8h]@1
  int v10; // [sp+8h] [bp-4h]@8
  count = 0;
  v9 = 0;
  if ( data && size && key1 )
  {
    key = 0x19660D * key1 + 0x3C6EF35F;
    n = size / 4;
    if ( size / 4 > 0 )
    {
      v9 = 4 * n;
      do
      {
        data[count] ^= key;
        key = 0x19660D * key + 0x3C6EF35F;
        ++count;
      }
      while ( count < n );
    }
    size_add = size % 4;
    if ( size % 4 )
    {
      v10 = 0;
      v7 = &data[count];
      memcpy(&v10, &data[count], size_add);
      v10 ^= key;
      memcpy(v7, &v10, size_add);
      v9 += size_add;
    }
  }
  return v9;
}

The packet structure:

struct HEAD{
    uint32 rnd1;
    uint32 rnd2;
    uint32 crc32;
};
 
struct BOT_INFO{
    uint32 field2;// 1
    uint32 field3;// 2
    uint32 field4;// 1
    uint32 field5;// 0
    uint32 field6;// 0
    uint32 field7;// 15
    uint32 rnd3[4];
    uint32 bid[4];
    uint32 instal_flag;
    uint32 len_host_crc32;
    uint32 host_crc32;
};
 
HEADER 0xC
97 73 BC F2 DB 00 76 E0  72 88 73 07
 
BOT_INFO 0x44
01 00 00 00 02 00 00 00  01 00 00 00 00 00 00 00
00 00 00 00 15 00 00 00  FA 13 29 40 56 6C 82 99
AF C5 DB F2 09 1F 35 4C  68 55 ED 52 F5 60 43 1E
1E 95 41 3A 33 21 C3 3B  0C 00 00 00 04 00 00 00
4B ED 16 27 00 00 00 00  00 00 00 00 00 00 00 00

DDoS

To mount DDoS attacks, the Trojan creates eight threads, picks a random address and sends a POST query to this address. The POST query:

http://%s/?ptrxcz_%s
or
http://%s/

The content and the string length are random. Also, once a connection to an SMTP server is established, the Trojan can send e-mails with arbitrary content via the server.

The bot saves itself into the folder % SYSTEM32% or %USERDIR% as regedit.exe and modifies the registry branch Software\Microsoft\Windows\CurrentVersion which is to be run at startup. It also modifies the registry branch SYSTEM\CurrentControlSet\Services\Tcpip\Parameters to increase the number of allowed TCP connections.

Spam machine

The Trojan uses a spam machine with a set of e-mail templates to send mass e-mails.

screen

Mailing list:

screen

A template containing a list of names:

screen

If the Trojan process is terminated abnormally, it can generate and send a corresponding error report to a remote server via UDP.

screen

Spam machine routine

All messages from the bot are sent as this data block:

struct MSG{
    DWORD size;
    BYTE data[size]; //encrypted data
};

The following routine is used for data encryption:

void ciper(char *key, char* data, int size){
    uint32 max=sizeof(KEY_ENC)-1;
    int j=0;
    if ( key && data ){
        if ( size > max){
            do{
                for (int i=0;i<max;i++){
                    data[i+j]^= key[i];
                }
 
                for (int i=0;i<max/2;i++){
                    char tmp = data[i+j];
                    data[i+j] = data[j-i+(max-1)];
                    data[j-i+(max-1)]= tmp;
                }
 
                if ( j & 1 ){
                    for (int i=0;i<max;i++){
                        data[i+j]=~data[i+j];
                    }
                }
                j+=max;
            }while (j+max< size );
        }
        size=size%max;
        for (int i=0;i<size;i++){
            data[i+j]=~data[i+j];
        }
    }
}

Encryption and decryption keys:

0xe0:eto ochen prostoarelkioiqyrut
0xe1:turyqioikleraotsorp nehco ote

Outbound message structure:

struct HEAD_REQ{
  DWORD bid;
  DWORD lip;
  DWORD bver;
  DWORD num_cfg;
  DWORD subop;
  DWORD os;
  WORD dns;
  WORD smtp;
};
 
DWORD size;
//data in this field is encrypted
HEAD_REQ head;
BYTE data[size];

Inbound packets:

struct HEAD_RES{
  DWORD cmd;
};
 
union U_OP{
  OP_0 op0;
  OP_1 op1;
  OP_4 op4;
  OP_5 op5;
  OP_6 op6;
  OP_7 op7;
  OP_8 op8;
};
 
struct OP_0{
};
 
 
 
struct OP_1{
  DWORD build;
  DWORD size;
};
 
 
struct OP_4{
};
 
struct OP_5{
  DWORD bid;
  DWORD remote_addr;
  DWORD seed_time;
  DWORD d4;
};
 
struct OP_6{
  DWORD num_tmpl;
  DWORD d2;
  DWORD d3;
  DWORD num_x;
  DWORD d5;
};
 
struct OP_7{
  DWORD flag_op;
  DWORD num_cfg;
};
 
 
struct OP_8{
  DWORD sub_opcode;
  BYTE b1;
};
 
 
enum OP_RES{
    OP_0 = 0, //stop mailing, clear templates
    OP_1 = 1, //list of name patterns
    OP_4 = 4, //update the bot
    OP_5 = 5, //bid initialization, determine the name of the compromised host
    OP_6 = 6, //spam templates
    OP_7 = 7, //main bot configuration file
    OP_8 = 8, //mailing list
};
 
DWORD size;
//data in this field is encrypted
HEAD_RES head;
U_OP op;
BYTE data[size+sizeof(op)+sizeof(HEAD_RES)];

The Trojan sends packets in the following sequence:

  1. Outbound. The bid has not been initialized (if the bot is being launched for the first time). Contains a local IP lip, OS version, dns-flags, bot version bver, the number of tested SMTP servers. And num_cfg = 0 0x1C
    00 00 00 00 C0 A8 EE 83  AC 01 00 00 00 00 00 00
    00 00 00 00 05 01 28 0A  20 00 04 00
  2. Inbound. OP_7, contains the main configuration file for the spam machine. 0x1F1
    07 00 00 00 01 00 00 00  08 00 00 00 75 64 70 73
    6F 63 6B 63 6F 75 6E 74  00 32 30 00 69 66 68 6F
    73 74 75 73 65 69 6E 6D  61 69 6C 66 72 6F 6D 00
    31 00 6D 61 78 74 72 79  63 6F 6E 6E 00 33 23 23
    23 23 00 62 63 63 00 30  00 65 78 65 5F 75 72 6C
    00 00 61 64 64 72 00 37  38 2E 34 36 2E 34 36 2E
    31 32 34 00 70 6F 72 74  00 32 35 00 6D 61 78 63
    6F 6E 6E 00 31 30 30 00  68 65 6C 6F 73 65 6C 65
    63 74 69 66 68 6F 73 74  00 33 00 74 72 79 61 67
    61 69 6E 74 72 79 00 33  00 6D 61 78 74 72 79 65
    72 72 00 32 00 64 69 65  69 66 6E 6F 73 70 61 6D
    00 31 30 00 6D 61 78 74  72 79 62 61 64 66 72 6F
    6D 00 32 00 63 6F 6E 73  74 63 6F 6E 6E 65 63 74
    00 31 00 63 6F 6D 5F 62  6F 74 5F 63 6F 6E 74 72
    5F 64 69 76 00 00 63 68  65 63 6B 73 6D 74 70 64
    65 6C 61 79 00 32 35 30  00 74 75 72 62 6F 6D 69
    6E 00 35 00 74 72 79 61  67 61 69 6E 70 61 75 73
    65 00 33 36 30 00 74 72  79 70 69 70 65 6C 69 6E
    69 6E 67 00 31 00 62 6F  74 5F 64 69 76 00 00 68
    65 6C 6F 73 65 6C 65 63  74 69 66 6E 6F 68 6F 73
    74 00 31 00 6B 6E 6F 63  6B 64 65 6C 61 79 00 36
    30 00 6D 61 78 74 72 79  62 6C 61 63 6B 00 32 00
    73 77 6F 74 74 69 6E 67  00 00 6D 61 78 75 64 70
    74 72 79 00 35 00 63 6F  6D 5F 62 6F 74 5F 64 69
    76 00 00 74 75 72 62 6F  6D 61 78 00 32 30 00 63
    63 00 30 00 75 64 70 72  65 63 76 74 69 6D 65 6F
    75 74 00 32 30 00 6D 78  63 6F 6E 6E 74 69 6D 65
    6F 75 74 00 38 30 00 62  6F 74 5F 63 6F 6E 74 72
    5F 64 69 76 00 00 73 61  76 65 75 6E 6B 61 6E 73
    77 00 00 6D 78 72 65 63  76 74 69 6D 65 6F 75 74
    00 38 30 00 6D 61 78 64  6F 6D 63 6F 6E 6E 00 32
    00

    screen

  3. Outbound. num_cfg=head.num_cfg 0x1C
    00 00 00 00 C0 A8 EE 83  AC 01 00 00 08 00 00 00
    00 00 00 00 05 01 28 0A  20 00 04 00
  4. Inbound. OP_5, includes the bid, assigned to the bot, external IP of the compromised host and timestamp. 0x14
    05 00 00 00 97 68 1F 00  5F D3 A8 0A C8 E1 53 51
    00 00 00 00
    The bot attempts to determine the host name for the external IP and sets a DNS flag.
  5. Outbound. num_cfg = head.num_cfg, dns | 1 and the assigned bid will now be present in all packets. 0x1C
    97 68 1F 00 C0 A8 EE 83  AC 01 00 00 08 00 00 00
    00 00 00 00 05 01 28 0A  21 00 04 00
  6. Inbound OP_8. Mailing list 0x35
    08 00 00 00 0B 00 00 00  00 50 41 59 56 45 53 55
    50 50 4F 52 54 40 41 45  58 50 2E 43 4F 4D 00 77
    70 70 69 6D 30 30 31 2E  41 45 58 50 2E 43 4F 4D
    00 0C 0A DB 1A
  7. Outbound. HEAD_REQ.subop=OP_8.sub_opcode, num_cfg=head.num_cfg 0x1C
    97 68 1F 00 C0 A8 EE 83  AC 01 00 00 08 00 00 00
    0B 00 00 00 05 01 28 0A  21 00 04 00
  8. Inbound. OP_6 spam template.
  9. Outbound. Similar to the previous one but contains more data. struct OP_1_EXT{
        DWORD field4;
        DWORD field5;
        DWORD field6;
        DWORD field7;
        DWORD field8;
    };
    0x1C
    97 68 1F 00 C0 A8 EE 83  AC 01 00 00 08 00 00 00
    0B 00 00 00 05 01 28 0A  21 00 04 00
     
    OP_1_EXT.field4=OP_6.num_tmpl;
    OP_1_EXT.field5=OP_6.d2;
    OP_1_EXT.field6=HEAD_REG.num_cfg;
     
  10. Inbound. OP_1 list of names.

And OP_1.num_tmpl==OP_6.num_tmpl template number.

Curing recommendations

  1. If the operating system (OS) can be loaded (either normally or in safe mode), download Dr.Web Security Space and run a full scan of your computer and removable media you use. More about Dr.Web Security Space.
  2. If you cannot boot the OS, change the BIOS settings to boot your system from a CD or USB drive. Download the image of the emergency system repair disk Dr.Web® LiveDisk , mount it on a USB drive or burn it to a CD/DVD. After booting up with this media, run a full scan and cure all the detected threats.
Download Dr.Web

Download by serial number

Use Dr.Web Anti-virus for macOS to run a full scan of your Mac.

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Download Dr.Web

Download by serial number

  1. If the mobile device is operating normally, download and install Dr.Web for Android. Run a full system scan and follow recommendations to neutralize the detected threats.
  2. If the mobile device has been locked by Android.Locker ransomware (the message on the screen tells you that you have broken some law or demands a set ransom amount; or you will see some other announcement that prevents you from using the handheld normally), do the following:
    • Load your smartphone or tablet in the safe mode (depending on the operating system version and specifications of the particular mobile device involved, this procedure can be performed in various ways; seek clarification from the user guide that was shipped with the device, or contact its manufacturer);
    • Once you have activated safe mode, install the Dr.Web for Android onto the infected handheld and run a full scan of the system; follow the steps recommended for neutralizing the threats that have been detected;
    • Switch off your device and turn it on as normal.

Find out more about Dr.Web for Android