Threat Encyclopedia

Description: 

Trend Micro has received multiple samples of this malware from a malicious domain source, http://bebebi.in, that have infected many clients. These indicate that this malware poses a high risk to users due to the increased possibility of infection.

To get a one-glance comprehensive view of the behavior of this malware, refer to the Threat Diagram shown below.

Malware Overview

This backdoor may be downloaded from certain remote sites.

It drops component files.

It connects to certain websites to send and receive information. However, as of this writing, the said sites are inaccessible.

It intercepts the user's browsing habit data and posts them on the said websites. It also obtains system information such as OS version and system locale.

It hooks to certain APIs to hide the malware's window.

Details:

Arrival Details

This backdoor may be downloaded from the following remote site(s):

• http://{BLOCKED}.in

Installation

This backdoor is loaded by PE_TDSS.A. It is assembled during system startup process and its content is saved directly to the harddisk without any file representation.

Other System Modifications

It modifies or creates the following registry entries:

HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\
main\FeatureControl\FEATURE_BROWSER_EMULATION
"Default" = "8888" (Web pages are displayed in Internet Explorer 8, regardless of the !DOCTYPE directive.)

HKEY_CURRENT_USER\Software\Microsoft\Windows\
CurrentVersion\Internet Settings
maxhttpredirects = "8888"
enablehttp1_1 = "1"

HKEY_CURRENT_USER\Software\Microsoft\Windows\
CurrentVersion\Internet Settings\zones\3
currentlevel = "0"
1601 = "0"
1400 = "0"

HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\
International
acceptlanguage = "en-us"

Backdoor Capabilities

It obtains the server URL from its CONFIG.INI file. If there's none, it sets the URL to http://{BLOCKED}a1i0.com then initializes the Internet connection.

It also obtains the APIs it needs for ActiveX control:

• AtlAdvise
• AtlUnadvise
• AtlAxCreateControlEx

It creates a window with the name svchost that gets, translates, and dispatches messages. If this action is successful, it sleeps for 60000ms, deletes the URL cache and downloads the malware file.

This backdoor connects to the following Web sites to send and receive information:

• http://{BLOCKED}3ja90a.com
• http://{BLOCKED}ga64aa17.com
• http://{BLOCKED}e3oo8as0.com
• http://{BLOCKED}1
• http://{BLOCKED}gh716zzl.com
• https://{BLOCKED}4cx00.cc
• https://{BLOCKED}0300z.com
• https://{BLOCKED}b0.com
• https://{BLOCKED}b0.com
• https://{BLOCKED}3.com
• https://{BLOCKED}fda88.com

However, as of this writing, the said sites are inaccessible.

It intercepts the user's browsing data by patching part of MSWSOCK.DLL in memory, particularly, part of the APIs used for Internet connection.

It saves and posts user's browsing habit information to above-mentioned servers by checking the following strings:

• www.google.
• search.yahoo.com
• www.bing.com
• .ask.com
• search.aol.com
• img.youtube.com
• upload.wikimedia.org
• .abmr.net
• .adbureau.net
• .adrevolver.com
• .aol.com
• .aolcdn.com
• .atdmt.com
• .bing.com
• .blinkx.com
• .doubleclick.net
• .everesttech.net
• .fimserve.com
• .google-analytics.com
• .google.
• .live.com
• .msn.com
• .othersonline.com
• .powerset.com
• .tribalfusion.com
• .yahoo.com
• .yieldmanager.com
• .yimg.com

Dropping Routine

This backdoor drops the following component file(s):

• %User Temp%\{random}.tmp - detected as TROJ_BREDO.SMXC

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003.)

Stealth Mechanism

It hooks the following APIs to hide the malware window:

• CoCreateInstance
• GetCursorPos

Other Details

It gets the following information from its CONFIG.INI:

• affid
• subid
• version
• installdate
• builddate
• rnd

It also gets the system's OS version and its locale.

It creates the mutex Global\\9e6af8f3-75f3-4b67-877a-c80125d7bc08 if the fully-qualified path of the executable file does not contain any of the following strings:

• *explo*
• *firefox*
• *chrome*
• *opera*
• *safari*
• *netsc*
• *avant*
• *browser*
• *mozill*
• *wuauclt*

It also creates the following mutexes:

• Global\\a68d7de8-eba6-4a54-90e0-9cb9d93b3ed7
• Global\\cc51461b-e32a-4883-8e97-e0706dc65415
• Global\\3006345f-6baf-4669-a7e1-aaa310564be9

Affected Platforms

This backdoor runs on Windows 2000, XP, and Server 2003.

Analysis By: Cris Pantanilla

Updated By: Ding Plazo

Revision History:

First pattern file version: 7.532.10

First pattern file release date: Oct 12, 2010

Important note: The "Minimum scan engine" refers to the earliest Trend Micro scan engine version guaranteed to detect this threat. However, Trend Micro strongly recommends that you update to the latest version in order to get comprehensive protection. Download the latest scan engine here.

Solution:

For Windows ME and XP users, before doing any scans, please make sure you disable System Restore to allow full scanning of your computer.  [Back]  Step 1: Scan your computer with your Trend Micro product and note files detected as BKDR_TIDSERV.DZ   Step 1: Scan your computer with your Trend Micro product and note files detected as BKDR_TIDSERV.DZ [Back]  Step 2: Restart in Safe Mode  [learn how]  Step 2: Restart in Safe Mode  [back] To restart in Safe Mode: • For Windows 98 and ME users Restart your computer. Press the CTRL key until the startup menu appears. Choose the Safe Mode option then press Enter. • For Windows NT (VGA mode) users Click Start>Settings>Control Panel. Double-click the System icon. Click the Startup/Shutdown tab. Set the Show List field to 10 seconds and click OK to save this change. Shut down and restart your computer. Select VGA mode from the startup menu. • For Windows 2000 users Restart your computer. Press the F8 key, when you see the Starting Windows bar at the bottom of the screen. Choose the Safe Mode option from the Windows Advanced Options Menu then press Enter. • For Windows XP users Restart your computer. Press F8 after the Power-On Self Test (POST) is done. If the Windows Advanced Options Menu does not appear, try restarting and then pressing F8 several times after the POST screen. Choose the Safe Mode option from the Windows Advanced Options Menu then press Enter. • For Windows Server 2003 users Restart your computer. Press F8 after Windows starts up. If the Windows Advanced Options Menu does not appear, try restarting again and then pressing F8 several times after restarting. On the Windows Advanced Option menu, use the arrow keys to select Safe Mode, and then press Enter.  Step 3: Search and delete the file detected as BKDR_TIDSERV.DZ  [learn how]  Step 3: Search and delete the file detected as BKDR_TIDSERV.DZ  [back] To search and delete the malware/grayware/spyware file: Right-click Start then click Search... or Find..., depending on the version of Windows you are running. In the Named input box, type the name(s) of the file(s) detected earlier. In the Look In drop-down list, select My Computer, then press Enter. Once located, select the file then press SHIFT+DELETE to permanently delete the file.  Step 4: Scan your computer with your Trend Micro product to delete files detected as BKDR_TIDSERV.DZ   *Note: If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check this Knowledge Base page for more information.  Step 4: Scan your computer with your Trend Micro product to delete files detected as BKDR_TIDSERV.DZ $$NOTES=If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check this Knowledge Base page for more information.$$ [Back]

Trend Micro offers best-of-breed antivirus and content-security solutions for your corporate network, small and medium business, mobile device or home PC.