Threat Encyclopedia

This backdoor is related to the spammed message about the Gaddafi Death picture.

To get a one-glance comprehensive view of the behavior of this Backdoor, refer to the Threat Diagram shown below.

Upon execution, this backdoor drops and opens a .JPG file to trick users into thinking that the executed file is legitimate and to hide its execution in the background. It contains a picture of Gaddafi.

This backdoor arrives as an attachment to email messages spammed by other malware/grayware or malicious users.

It opens a hidden Internet Explorer window. However, as of this writing, the said sites are inaccessible.

Arrival Details

This backdoor arrives as an attachment to email messages spammed by other malware/grayware or malicious users.

Installation

This backdoor drops the following component file(s):

• %User Temp%\explorer.exe - also detected as BKDR_EXDEPH.A
• %Program Files%\WindowsUpdate\winupdate.exe.exe - also detected as BKDR_EXDEPH.A

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003.. %Program Files% is the default Program Files folder, usually C:\Program Files.)

Autostart Technique

This backdoor adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
update = "{Malware Path and File Name}"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
WindowsUpdate = "%Program Files%\WindowsUpdate\winupdate.exe.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Active Setup\Installed Components\{L2YPI760-53VH-1121-351O-EL7076Y0V6C2}
StubPath = "%Program Files%\WindowsUpdate\winupdate.exe.exe Restart"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
update = "{Malware Path and File Name}"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
WindowsUpdate = "%Program Files%\WindowsUpdate\winupdate.exe.exe"

Other System Modifications

This backdoor adds the following registry entries as part of its installation routine:

HKEY_CURRENT_USER\Software\$GADAHFI$
FirstExecution = "{HEX Values}"

HKEY_CURRENT_USER\Software\$GADAHFI$
FileName = "{HEX Values}"

HKEY_CURRENT_USER\Software\$GADAHFI$
HKLM = "{HEX Values}"

HKEY_CURRENT_USER\Software\$GADAHFI$
HKCU = "{HEX Values}"

HKEY_CURRENT_USER\Software\Cerberus
StartPersist = "{HEX Values}"

Backdoor Routine

This backdoor opens the following port(s) where it listens for remote commands:

• TCP 8521

It opens a hidden Internet Explorer window.

It connects to the following URL(s) to send and receive commands from a remote malicious user:

• {BLOCKED}ne.{BLOCKED}pto.org

However, as of this writing, the said sites are inaccessible.

NOTES:

Upon execution, this backdoor drops and opens the following .JPG file to trick users into thinking that the executed file is legitimate and to hide its execution in the background:

• %System Root%\Gaddafi.jpg

The said .JPG file contains the following picture of Gaddafi: