Threat Encyclopedia

This malware arrives as an executable file infected by a file infector malware detected as PE_SALITY.AC. This consequently executes both payloads of BKDR_RILER.SVR and PE_SALITY.AC on the affected system.

To get a one-glance comprehensive view of the behavior of this Backdoor, refer to the Threat Diagram shown below.

This backdoor may be dropped by other malware.

It connects to a website to send and receive information.

Arrival Details

This backdoor may be dropped by the following malware:

• TROJ_ARTIEF.EDX

Installation

This backdoor drops the following files:

• %System%\goopnet.ini - contains the path and filename of the executed malware
• %System%\utntweep.dll - also detected as BKDR_RILER.SVR

(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.)

Backdoor Routine

This backdoor connects to the following websites to send and receive information:

• losang.{BLOCKED}dns.co.uk

NOTES:

As an autostart technique, it registers its DLL component as Layered Service Provider (LSP) by creating the following registry entry:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\0000000000{2 digit numbers}
PackedCatalogItem = "%System%\utntweep.dll"

The DLL component contains the backdoor routines of this malware. The DLL component first checks if it is injected in any of the following processes before continuing execution:

• explorer.exe
• firefox.exe
• lsvchost.exe
• msimn.exe
• msnmsgr.exe
• netscp.exe
• opera.exe
• outlook.exe
• safari.exe
• yahoomessenger.exe

Otherwise, it terminates.

It is capable of reporting the following information to its C&C server:

• Host name
• IP address
• Malware file size
• Malware version
• Operating system

It may then open a hidden instance of COMMAND.COM or CMD.EXE process in order to allow remote command shell access to the attacker.