Content

BackDoor-DKA

Type
Internet Worm
SubType
Remote Access
Discovery Date
11/09/2006
Length
varies
Minimum DAT
4892 (11/09/2006)
Updated DAT
6448 (08/24/2011)
Minimum Engine
5.2.00
Description Added
11/09/2006
Description Modified
10/01/2009 12:35 AM (PT)
Risk Assessment
Corporate User
Low
Home User
Low

Tab Navigation

Characteristics

This Backdoor attempts to place an Autorun.inf file in its root directory and if this drive shared across the network then other remote computers become victimized anytime while trying to access the shared folders or directories.

Files found in system are:
c:\auto.exe
c:\autorun.inf
%System%\3C7780C0.DLL - this dll is injected into all running processes

Reistry keys get added to the system:

• HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_F188AD40
• HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_F188AD40\0000
• HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_F188AD40\0000\Control
• HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\F188AD40
• HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\F188AD40\Security
• HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\F188AD40\Enum
• HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_F188AD40
• HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_F188AD40\0000
• HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_F188AD40\0000\Control
• HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\F188AD40
• HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\F188AD40\Security
• HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\F188AD40\Enum
• HKEY_USERS\.DEFAULT\SYSTEM
• HKEY_USERS\.DEFAULT\SYSTEM\CurrentControlSet
• HKEY_USERS\.DEFAULT\SYSTEM\CurrentControlSet\Services
• HKEY_USERS\.DEFAULT\SYSTEM\CurrentControlSet\Services\F188AD40
• HKEY_CURRENT_USER\SYSTEM
• HKEY_CURRENT_USER\SYSTEM\CurrentControlSet
• HKEY_CURRENT_USER\SYSTEM\CurrentControlSet\Services
• HKEY_CURRENT_USER\SYSTEM\CurrentControlSet\Services\F188AD40

Newly Registry Values created

• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT]
  ReportBootOk = 0x00000001

• [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_F188AD40\0000\Control]
 *NewlyCreated* = 0x00000000
 ActiveService = "F188AD40"

• [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_F188AD40\0000]
 Service = "F188AD40"
 Legacy = 0x00000001
 ConfigFlags = 0x00000000
 Class = "LegacyDriver"
 ClassGUID = "{8ECC055D-047F-11D1-A537-0000F8753ED1}"
 DeviceDesc = "F188AD40"

• [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_F188AD40]
 NextInstance = 0x00000001

• [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\F188AD40\Enum]
 0 = "Root\LEGACY_F188AD40\0000"
 Count = 0x00000001
 NextInstance = 0x00000001

• [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\F188AD40\Security]
 Security = 01 00 14 80 90 00 00 00 9C 00 00 00 14 00 00 00 30 00 00 00 02 00 1C 00 01 00 00 00 02 80 14 00 FF 01 0F 00 01 01 00 00 00 00 00 01 00 00 00 00 02 00 60 00 04 00 00 00 00 00 14 00 FD 01 02 00 01 01 00 00 00 00 00 05 12 00 00 00 00 00 18 00 FF 01 0F 0

• [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\F188AD40]
 Type = 0x00000010
 Start = 0x00000002
 ErrorControl = 0x00000001
 ImagePath = "%System%\4E17C240.EXE -k"
 DisplayName = "F188AD40"
 ObjectName = "LocalSystem"
 Description = "3C7780C0"

• [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_F188AD40\0000\Control]
 *NewlyCreated* = 0x00000000
 ActiveService = "F188AD40"

• [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_F188AD40\0000]
 Service = "F188AD40"
 Legacy = 0x00000001
 ConfigFlags = 0x00000000
 Class = "LegacyDriver"
 ClassGUID = "{8ECC055D-047F-11D1-A537-0000F8753ED1}"
 DeviceDesc = "F188AD40"

• [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_F188AD40]
 NextInstance = 0x00000001

• [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\F188AD40\Enum]
 0 = "Root\LEGACY_F188AD40\0000"
 Count = 0x00000001
 NextInstance = 0x00000001

• [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\F188AD40\Security]
 Security = 01 00 14 80 90 00 00 00 9C 00 00 00 14 00 00 00 30 00 00 00 02 00 1C 00 01 00 00 00 02 80 14 00 FF 01 0F 00 01 01 00 00 00 00 00 01 00 00 00 00 02 00 60 00 04 00 00 00 00 00 14 00 FD 01 02 00 01 01 00 00 00 00 00 05 12 00 00 00 00 00 18 00 FF 01 0F 0

• [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\F188AD40]
 Type = 0x00000010
 Start = 0x00000002
 ErrorControl = 0x00000001
 ImagePath = "%System%\4E17C240.EXE -k"
 DisplayName = "F188AD40"
 ObjectName = "LocalSystem"
 Description = "3C7780C0"

Registry Values were modified:

• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PCHealth\ErrorReporting]
 DoReport = 
 ShowUI =

• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL]
 CheckedValue =

• [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\ServiceCurrent]

• [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ServiceCurrent


 

Symptoms

• Attemptsto establish connection with remote host: 203.xxx.xxx.232
• Outgoing HTTP traffic will be seen from the victim machine, to the following server:
hxxp://nx.xxxbb.cn/xxx//update.txt
• Existence of the files/Registry keys detailed above

Method of Infection

• Virus may propagate via network shares or removable drives

Removal

All Users:
Use current engine and DAT files for detection and removal.

Modifications made to the system Registry and/or INI files for the purposes of hooking system startup, will be successfully removed if cleaning with the recommended engine and DAT combination (or higher).

Variants

Variants

    N/A

All Information

Overview -

Backdoor-DKA provides remote access capabilities to an attacker by opening a backdoor on the compromised machine. This detection is for a worm that attempts to copy itself to the root of any accessible disk volumes.

Aliases

  • Backdoor.Win32.Popwin.bda [Kaspersky Lab]
  • Backdoor:Win32/Popwin.B [Microsoft]
  • W32.Popwin [Symantec]
  • Win-Trojan/Popwin.18476 [AhnLab]

Characteristics

Characteristics -

This Backdoor attempts to place an Autorun.inf file in its root directory and if this drive shared across the network then other remote computers become victimized anytime while trying to access the shared folders or directories.

Files found in system are:
c:\auto.exe
c:\autorun.inf
%System%\3C7780C0.DLL - this dll is injected into all running processes

Reistry keys get added to the system:

• HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_F188AD40
• HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_F188AD40\0000
• HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_F188AD40\0000\Control
• HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\F188AD40
• HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\F188AD40\Security
• HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\F188AD40\Enum
• HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_F188AD40
• HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_F188AD40\0000
• HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_F188AD40\0000\Control
• HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\F188AD40
• HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\F188AD40\Security
• HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\F188AD40\Enum
• HKEY_USERS\.DEFAULT\SYSTEM
• HKEY_USERS\.DEFAULT\SYSTEM\CurrentControlSet
• HKEY_USERS\.DEFAULT\SYSTEM\CurrentControlSet\Services
• HKEY_USERS\.DEFAULT\SYSTEM\CurrentControlSet\Services\F188AD40
• HKEY_CURRENT_USER\SYSTEM
• HKEY_CURRENT_USER\SYSTEM\CurrentControlSet
• HKEY_CURRENT_USER\SYSTEM\CurrentControlSet\Services
• HKEY_CURRENT_USER\SYSTEM\CurrentControlSet\Services\F188AD40

Newly Registry Values created

• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT]
  ReportBootOk = 0x00000001

• [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_F188AD40\0000\Control]
 *NewlyCreated* = 0x00000000
 ActiveService = "F188AD40"

• [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_F188AD40\0000]
 Service = "F188AD40"
 Legacy = 0x00000001
 ConfigFlags = 0x00000000
 Class = "LegacyDriver"
 ClassGUID = "{8ECC055D-047F-11D1-A537-0000F8753ED1}"
 DeviceDesc = "F188AD40"

• [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_F188AD40]
 NextInstance = 0x00000001

• [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\F188AD40\Enum]
 0 = "Root\LEGACY_F188AD40\0000"
 Count = 0x00000001
 NextInstance = 0x00000001

• [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\F188AD40\Security]
 Security = 01 00 14 80 90 00 00 00 9C 00 00 00 14 00 00 00 30 00 00 00 02 00 1C 00 01 00 00 00 02 80 14 00 FF 01 0F 00 01 01 00 00 00 00 00 01 00 00 00 00 02 00 60 00 04 00 00 00 00 00 14 00 FD 01 02 00 01 01 00 00 00 00 00 05 12 00 00 00 00 00 18 00 FF 01 0F 0

• [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\F188AD40]
 Type = 0x00000010
 Start = 0x00000002
 ErrorControl = 0x00000001
 ImagePath = "%System%\4E17C240.EXE -k"
 DisplayName = "F188AD40"
 ObjectName = "LocalSystem"
 Description = "3C7780C0"

• [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_F188AD40\0000\Control]
 *NewlyCreated* = 0x00000000
 ActiveService = "F188AD40"

• [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_F188AD40\0000]
 Service = "F188AD40"
 Legacy = 0x00000001
 ConfigFlags = 0x00000000
 Class = "LegacyDriver"
 ClassGUID = "{8ECC055D-047F-11D1-A537-0000F8753ED1}"
 DeviceDesc = "F188AD40"

• [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_F188AD40]
 NextInstance = 0x00000001

• [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\F188AD40\Enum]
 0 = "Root\LEGACY_F188AD40\0000"
 Count = 0x00000001
 NextInstance = 0x00000001

• [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\F188AD40\Security]
 Security = 01 00 14 80 90 00 00 00 9C 00 00 00 14 00 00 00 30 00 00 00 02 00 1C 00 01 00 00 00 02 80 14 00 FF 01 0F 00 01 01 00 00 00 00 00 01 00 00 00 00 02 00 60 00 04 00 00 00 00 00 14 00 FD 01 02 00 01 01 00 00 00 00 00 05 12 00 00 00 00 00 18 00 FF 01 0F 0

• [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\F188AD40]
 Type = 0x00000010
 Start = 0x00000002
 ErrorControl = 0x00000001
 ImagePath = "%System%\4E17C240.EXE -k"
 DisplayName = "F188AD40"
 ObjectName = "LocalSystem"
 Description = "3C7780C0"

Registry Values were modified:

• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PCHealth\ErrorReporting]
 DoReport = 
 ShowUI =

• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL]
 CheckedValue =

• [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\ServiceCurrent]

• [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ServiceCurrent


 

Symptoms

Symptoms -

• Attemptsto establish connection with remote host: 203.xxx.xxx.232
• Outgoing HTTP traffic will be seen from the victim machine, to the following server:
hxxp://nx.xxxbb.cn/xxx//update.txt
• Existence of the files/Registry keys detailed above

Method of Infection

Method of Infection -

• Virus may propagate via network shares or removable drives

Removal -

Removal -

All Users:
Use current engine and DAT files for detection and removal.

Modifications made to the system Registry and/or INI files for the purposes of hooking system startup, will be successfully removed if cleaning with the recommended engine and DAT combination (or higher).

Variants

Variants -

    N/A