BackDoor.Wirenet.213

Technical Information

To ensure autorun and distribution

Creates or modifies the following files

%APPDATA%\microsoft\windows\start menu\programs\startup\sybabcgxzwxb.lnk

Malicious functions

Injects code into

the following system processes:

%WINDIR%\microsoft.net\framework\v4.0.30319\regsvcs.exe
%WINDIR%\microsoft.net\framework\v2.0.50727\regsvcs.exe
%WINDIR%\syswow64\wscript.exe

Searches for registry branches where third party applications store passwords

[HKCU\Software\Far\Plugins\FTP\Hosts]
[HKCU\Software\SimonTatham\PuTTY\Sessions]
[HKCU\Software\LinasFTP\Site Manager]
[HKLM\SOFTWARE\Robo-FTP 3.7\Scripts]
[HKLM\SOFTWARE\Wow6432Node\Robo-FTP 3.7\Scripts]
[HKCU\SOFTWARE\Robo-FTP 3.7\Scripts]
[HKLM\SOFTWARE\Wow6432Node\Robo-FTP 3.7\FTPServers]
[HKCU\SOFTWARE\Robo-FTP 3.7\FTPServers]
[HKCU\Software\FlashPeak\BlazeFtp\Settings]
[HKLM\Software\Wow6432Node\South River Technologies\WebDrive\Connections]
[HKCU\Software\South River Technologies\WebDrive\Connections]
[HKLM\Software\Wow6432Node\Martin Prikryl]
[HKCU\Software\Martin Prikryl]
[HKLM\Software\Wow6432Node\SoftX.org\FTPClient\Sites]
[HKCU\Software\SoftX.org\FTPClient\Sites]
[HKLM\Software\Wow6432Node\FTPClient\Sites]
[HKCU\Software\FTPClient\Sites]
[HKLM\SOFTWARE\Wow6432Node\NCH Software\Fling\Accounts]
[HKCU\SOFTWARE\NCH Software\Fling\Accounts]
[HKCU\Software\NCH Software\ClassicFTP\FTPAccounts]
[HKLM\Software\Wow6432Node\SimonTatham\PuTTY\Sessions]
[HKCU\Software\CoffeeCup Software]
[HKLM\Software\Wow6432Node\CoffeeCup Software]
[HKCU\Software\MAS-Soft\FTPInfo\Setup]
[HKCU\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts]
[HKLM\Software\Microsoft\Internet Account Manager]
[HKLM\Software\Wow6432Node\Microsoft\Internet Account Manager]
[HKCU\Identities\{1BC91121-7903-48EE-BF78-1BC7CA4B5761}\Software\Microsoft\Internet Account Manager\Accounts]
[HKCU\Software\Microsoft\Internet Account Manager\Accounts]
[HKLM\Software\RIT\The Bat!\Users depot]
[HKLM\Software\Wow6432Node\RIT\The Bat!\Users depot]
[HKLM\Software\RIT\The Bat!]
[HKLM\Software\Wow6432Node\RIT\The Bat!]
[HKCU\Software\RIT\The Bat!]
[HKCU\Software\RIT\The Bat!\Users depot]
[HKLM\Software\RimArts\B2\Settings]
[HKLM\Software\Wow6432Node\RimArts\B2\Settings]
[HKCU\Software\RimArts\B2\Settings]
[HKCU\Software\Microsoft\Windows Mail]
[HKCU\Software\Microsoft\Windows Live Mail]
[HKLM\Software\Wow6432Node\Nico Mak Computing\WinZip\mru\jobs]
[HKCU\Software\Nico Mak Computing\WinZip\mru\jobs]
[HKLM\Software\Wow6432Node\Nico Mak Computing\WinZip\FTP]
[HKCU\Software\Nico Mak Computing\WinZip\FTP]
[HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Microsoft Outlook Internet Settings]
[HKLM\Software\Wow6432Node\NCH Software\ClassicFTP\FTPAccounts]
[HKCU\Software\ExpanDrive\Sessions]
[HKCU\Software\Cryer\WebSitePublisher]
[HKCU\Software\FlashFXP]
[HKCU\Software\FlashFXP\3]
[HKCU\Software\GlobalSCAPE\CuteFTP 8 Professional\QCToolbar]
[HKCU\Software\GlobalSCAPE\CuteFTP 8 Home\QCToolbar]
[HKCU\Software\GlobalSCAPE\CuteFTP 7 Professional\QCToolbar]
[HKCU\Software\GlobalSCAPE\CuteFTP 7 Home\QCToolbar]
[HKCU\Software\GlobalSCAPE\CuteFTP 6 Professional\QCToolbar]
[HKCU\Software\GlobalSCAPE\CuteFTP 6 Home\QCToolbar]
[HKLM\Software\Ghisler\Total Commander]
[HKLM\Software\Wow6432Node\Ghisler\Total Commander]
[HKCU\Software\Ghisler\Total Commander]
[HKLM\Software\Ghisler\Windows Commander]
[HKLM\Software\Wow6432Node\Ghisler\Windows Commander]
[HKCU\Software\Ghisler\Windows Commander]
[HKCU\Software\Far Manager\SavedDialogHistory\FTPHost]
[HKCU\Software\Far2\SavedDialogHistory\FTPHost]
[HKCU\Software\Far\SavedDialogHistory\FTPHost]
[HKCU\Software\Far Manager\Plugins\FTP\Hosts]
[HKCU\Software\Far2\Plugins\FTP\Hosts]
[HKLM\Software\Wow6432Node\FlashFXP\3]
[HKLM\Software\FlashFXP\3]
[HKLM\Software\Wow6432Node\FlashFXP]
[HKLM\Software\FlashFXP]
[HKCU\Software\FTP Explorer\Profiles]
[HKCU\Software\FTP Explorer\FTP Explorer\Workspace\MFCToolBar-224]
[HKCU\Software\FTPWare\COREFTP\Sites]
[HKCU\Software\CoffeeCup Software\Internet\Profiles]
[HKCU\Software\Sota\FFFTP\Options]
[HKCU\Software\Sota\FFFTP]
[HKLM\Software\TurboFTP]
[HKLM\Software\Wow6432Node\TurboFTP]
[HKCU\Software\TurboFTP]
[HKCU\Software\BulletProof Software\BulletProof FTP Client\Options]
[HKCU\Software\BPFTP]
[HKCU\Software\BPFTP\Bullet Proof FTP\Options]
[HKCU\Software\BulletProof Software\BulletProof FTP Client\Main]
[HKCU\Software\BPFTP\Bullet Proof FTP\Main]
[HKLM\Software\FileZilla Client]
[HKLM\Software\Wow6432Node\FileZilla Client]
[HKLM\Software\FileZilla]
[HKLM\Software\Wow6432Node\FileZilla]
[HKCU\Software\FileZilla Client]
[HKCU\Software\FileZilla]
[HKCU\Software\VanDyke\SecureFX]
[HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook]

Reads files which store third party applications passwords

%LOCALAPPDATA%\google\chrome\user data\default\web data
%LOCALAPPDATA%\google\chrome\user data\default\login data

Brute-forces OS accounts.

Modifies file system

Creates the following files

%TEMP%\ixp000.tmp\fgfbhb~1.exe
%TEMP%\aut95c9.tmp
%TEMP%\ixp000.tmp\ifgy.exe
%TEMP%\aut96f2.tmp
%TEMP%\ixp000.tmp\lunec
%APPDATA%\ifgy.exe
%APPDATA%\lunec
%TEMP%\1104003.bat
%TEMP%\1109697.bat
%TEMP%\1113769.bat
%TEMP%\1117856.bat
%TEMP%\1122583.bat
%TEMP%\1127232.bat

Sets the 'hidden' attribute to the following files

%HOMEPATH%\lsml1q6eeddldfmv\ifgy.exe
%HOMEPATH%\lsml1q6eeddldfmv\lunec

Deletes the following files

%TEMP%\aut95c9.tmp
%TEMP%\aut96f2.tmp
%TEMP%\ixp000.tmp\fgfbhb~1.exe
%TEMP%\ixp000.tmp\ifgy.exe
%TEMP%\ixp000.tmp\lunec
%WINDIR%\microsoft.net\framework\v4.0.30319\regsvcs.exe
%WINDIR%\microsoft.net\framework\v2.0.50727\regsvcs.exe
%WINDIR%\syswow64\wscript.exe

Moves the following files

from %APPDATA%\lunec to %HOMEPATH%\lsml1q6eeddldfmv\lunec
from %APPDATA%\ifgy.exe to %HOMEPATH%\lsml1q6eeddldfmv\ifgy.exe

Network activity

Connects to

'po###ouse.mobi':80

TCP

HTTP GET requests

http://po###ouse.mobi/main.php?di###############################################

UDP

DNS ASK po###ouse.mobi

Miscellaneous

Creates and executes the following

'%TEMP%\ixp000.tmp\fgfbhb~1.exe'
'%APPDATA%\ifgy.exe' "%APPDATA%\LUNEC"

Executes the following

'%WINDIR%\microsoft.net\framework\v4.0.30319\regsvcs.exe'
'%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\1104003.bat" "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe" "
'%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\1109697.bat" "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe" "
'%WINDIR%\microsoft.net\framework\v2.0.50727\regsvcs.exe'
'%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\1113769.bat" "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe" "
'%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\1117856.bat" "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe" "
'%WINDIR%\syswow64\wscript.exe'
'%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\1122583.bat" "%WINDIR%\SysWOW64\wscript.exe" "
'%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\1127232.bat" "%WINDIR%\SysWOW64\wscript.exe" "
'%TEMP%\ixp000.tmp\fgfbhb~1.exe' ' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\1104003.bat" "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe" "' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\1109697.bat" "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe" "' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\1113769.bat" "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe" "' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\1117856.bat" "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe" "' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\1122583.bat" "%WINDIR%\SysWOW64\wscript.exe" "' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\1127232.bat" "%WINDIR%\SysWOW64\wscript.exe" "' (with hidden window)

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical Information

Curing recommendations

Free trial