ThreatExpert Report: Backdoor.Win32.Reload

Visit ThreatExpert web site

Close Report

Submission Summary:

Submission details:

Submission received: 1 October 2012, 19:17:45
Processing time: 9 min 49 sec
Submitted sample:

File MD5: 0x8F0756A0ADB9141B6322CF8DCA7D6B6A
File SHA-1: 0xFDC2089F2D7B3488EE0FD6F238342A1292A4D213
Filesize: 2,692,608 bytes
Alias & packer info:

Backdoor.Win32.Reload [Ikarus]
packed with: UPX [Kaspersky Lab]

Summary of the findings:

What's been found	Severity Level
Capability to send out email message(s) with the built-in SMTP client engine.
Communication with a remote SMTP server and sending out email.
Downloads/requests other files from Internet.
Creates a startup registry entry.

Technical Details:

File System Modifications

The following files were created in the system:

#	Filename(s)	File Size	File Hash
1	%Temp%\bb.txt %Temp%\brada.txt %Temp%\cbch.txt %Temp%\cit.txt %Temp%\cx.txt %Temp%\itoca.txt %Temp%\nossa.txt %Temp%\prime.txt %Temp%\[filename of the sample #1] %Temp%\santa.txt %Temp%\sic.txt	125 bytes	MD5: 0x7C5F5A68051F6B0C0E9A2AD33C40D415 SHA-1: 0x120865765927A61AF83F02B83DC297EEDE61EC41
2	%Temp%\info_%ComputerName%.dat	210 bytes	MD5: 0x20962F900103321B4471ED0250CED74A SHA-1: 0xE189CC3AF00E76F30D1584257FF97A9B9ACC996C
3	%Temp%\upd.bat	405 bytes	MD5: 0x2682A0CD34C41B11D019D4EC2580CB9E SHA-1: 0xB709CBF483DA2743AEBE2FA58DC4F120F7FCCF39

Note:

%Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).

Memory Modifications

There was a new process created in the system:

Process Name	Process Filename	Main Module Size
[filename of the sample #1]	[file and pathname of the sample #1]	10,711,040 bytes

Registry Modifications

The newly created Registry Value is:

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]

[filename of the sample #1] = "[file and pathname of the sample #1]"

so that [file and pathname of the sample #1] runs every time Windows starts

Other details

The following Host Names were requested from a host database:

www.mfox2011.com
smtp.gmail.com

The following HTTP URLs were started reading:

http://www.mfox2011.com/links_loader_nervoso/upd22.exe
http://www.mfox2011.com/links_loader_nervoso/bb.txt
http://www.mfox2011.com/links_loader_nervoso/brada.txt
http://www.mfox2011.com/links_loader_nervoso/prime.txt
http://www.mfox2011.com/links_loader_nervoso/cx.txt
http://www.mfox2011.com/links_loader_nervoso/santa.txt
http://www.mfox2011.com/links_loader_nervoso/nossa.txt
http://www.mfox2011.com/links_loader_nervoso/itoca.txt
http://www.mfox2011.com/links_loader_nervoso/cbch.txt
http://www.mfox2011.com/links_loader_nervoso/sic.txt
http://www.mfox2011.com/links_loader_nervoso/cit.txt

Generated SMTP traffic

Email Sender:

Antonio Farinha <antoniofarinha2012@gmail.com>

Email Recipients:

smktservers@live.com
caixotesystem@gmail.com

Email Subject:

Info - COMPUTERNAME

Email Body:

------------------------------ PC Nome..: COMPUTERNAME Mac Placa: Serial HD: 00404908 IP.......: 127.0.0.1 ------------------------------ Data/Hora: 10/1/2012 7:18:01 PM ------------------------------ .

For example, the generated email message may look similar to the one shown below:

All content ("Information") contained in this report is the copyrighted work of Threat Expert Ltd and its associated companies ("ThreatExpert") and may not be copied without the express permission of ThreatExpert.

The Information is provided on an "as is" basis. ThreatExpert disclaims all warranties, whether express or implied, to the maximum extent permitted by law, including the implied warranties that the Information is merchantable, of satisfactory quality, accurate, fit for a particular purpose or need, or non-infringing, unless such implied warranties are legally incapable of exclusion. Further, ThreatExpert does not warrant or make any representations regarding the use or the results of the use of the Information in terms of their correctness, accuracy, reliability, or otherwise.