BDS/GrayBird.LE - Backdoor Server

See also

Summary

Full description

Statistics

Virus:	BDS/GrayBird.LE
Date discovered:	21/09/2006
Type:	Backdoor Server
In the wild:	No
Reported Infections:	Low
Distribution Potential:	Low
Damage Potential:	Medium
Static file:	Yes
File size:	384.835 Bytes
MD5 checksum:	aba8e6611ab80E5d747b32464674faf6
VDF version:	6.35.01.115 - Mon, 21 Aug 2006 06:54 (GMT+1)
IVDF version:	6.35.01.116 - Mon, 21 Aug 2006 09:55 (GMT+1)

General Method of propagation:
   • No own spreading routine

Aliases:
   • Mcafee: BackDoor-ARR trojan
   • Kaspersky: Backdoor.Win32.GrayBird.le
   • Sophos: Troj/Bckdr-OXB
   • Bitdefender: Backdoor.Graybird.FN

Platforms / OS:
   • Windows 95
   • Windows 98
   • Windows 98 SE
   • Windows NT
   • Windows ME
   • Windows 2000
   • Windows XP
   • Windows 2003

Side effects:
   • Downloads a file
   • Drops a file
   • Registry modification
   • Third party control

Files It copies itself to the following location:
• %WINDIR%\Hacker.com.cn.ini

It deletes the initially executed copy of itself.

The following file is created:

– %WINDIR%\uninstal.bat Furthermore it gets executed after it was fully created. This batch file is used to delete a file.

It tries to download a file:

– The location is the following:
• http://www.bfliao.27h.com/**********
At the time of writing this file was not online for further investigation.

Registry The following registry keys are added:

– [HKLM\SYSTEM\CurrentControlSet\Services\Windows XP Vista ]
   • "Type"=dword:00000110
   • "Start"=dword:00000002
   • "ErrorControl"=dword:00000000
   • "ImagePath"="%WINDIR%\Hacker.com.cn.ini"
   • "DisplayName"="Windows XP Vista "
   • "ObjectName"="LocalSystem"
   • "Description"="»Ò¸ë×Ó·þÎñ¶Ë³ÌÐò¡£Ô¶³Ì¼à¿Ø¹ÜÀí."

– [HKLM\SYSTEM\CurrentControlSet\Services\Windows XP Vista \
   Security]
   • "Security"=%hex values%

– [HKLM\SYSTEM\CurrentControlSet\Services\Windows XP Vista \
   Enum]
   • "0"="Root\LEGACY_WINDOWS_XP_VISTA________\0000"

– [HKLM\SYSTEM\CurrentControlSet\Enum\Root\
   LEGACY_WINDOWS_XP_VISTA________\0000\Control]
   • "*NewlyCreated*"=dword:00000000
   • "ActiveService"="Windows XP Vista "

Backdoor The following port is opened:

– %PROGRAM FILES%\Internet Explorer\IEXPLORE.EXE on TCP port 8080 in order to provide an HTTP server.

Remote control capabilities:
    • Disable network shares
    • Enable network shares
    • Execute file

Miscellaneous Mutex:
It creates the following Mutex:
• Hacker.com.cn_MUTEX

Anti debugging
It checks if the following program is running:
• SoftIce

File details Programming language:
The malware program was written in Delphi.

Runtime packer:
In order to aggravate detection and reduce size of the file it is packed with the following runtime packer:
• PEPack

See a brief description here.

Description inserted by Monica Ghitun on Thu, 21 Sep 2006 16:11 (GMT+1)
Description updated by Andrei Ivanes on Thu, 19 Oct 2006 14:18 (GMT+1)

» About Malware
» About Phishing
» Viruses In the Wild

« back