Additional Details
This backdoor is detected as a member of the Hupigon family. The
Backdoor:W32/Hupigon description provides additional details.
Copies itself to:
- %Windows%\dllhost.exe
- %Windows%\setuprs1.PIF
Replicates these original Windows applications with an additional "EXE" extension:
- %Windows%\system32\cmd.exe to %Windows%\system32\cmd.exe.exe
- %Windows%\regedit.exe to %Windows%\regedit.exe.exe
Hupigon.EMV attempts to disable/redirect Windows applications using the following registry entries:
- HKLM\Software\Microsoft\Windows NT\
CurrentVersion\Image File Execution Options\cmd.exe
Debugger = setuprs1.PIF
- HKLM\Software\Microsoft\Windows NT\
CurrentVersion\Image File Execution Options\regedit.exe
Debugger = setuprs1.PIF
- HKLM\Software\Microsoft\Windows NT\
CurrentVersion\Image File Execution Options\regedt32.exe
Debugger = setuprs1.PIF
- HKLM\Software\Microsoft\Windows NT\
CurrentVersion\Image File Execution Options\msconfig.exe
Debugger = 7303.PIF
Registers itself as Windows COM+ System Application service using these registry entries:
- HKLM\System\CurrentControlSet\Services\COMSystemApp
Type = 00000110
- HKLM\System\CurrentControlSet\Services\COMSystemApp
ErrorControl = 00000000
- HKLM\System\CurrentControlSet\Services\COMSystemApp
ImagePath = C:\WINDOWS\dllhost.exe -netsvcs
- HKLM\System\CurrentControlSet\Services\COMSystemApp
DisplayName = COM+ System Applications
Attempts to locate and terminate the following process:
- 360tray.exe
- autoruns.exe
- avp.exe
- avpcc.exe
- cpf.exe
- ewido.exe
- FireTray.exe
- FireWall.exe
- FYFireWall.exe
- jpf.exe
- kav.exe
- KAVPF.exe
- KavPFW.EXE
- kpf4gui.exe
- KPFW32.EXE
- KVCenter.kxp
- KvMonXP.kxp
- KVXP.kxp
- McAfeeFire.exe
- mmc.exe
- outpost.exe
- PFW.exe
- procexp.exe
- Ras.exe
- RfwMain.EXE
- RRfwMain.EXE
- runiep.exe
- ssgui.exe
- SysSafe.exe
- TrojDie.kxp
- WoptiProcess.exe
Attempts to close windows containing these strings:
Attempts to connect to 218.16.138.64 on TCP port 81.
Propagation
It attempts to propagate by creating "\runauto..\autorun.pif" and "\autorun.inf" on all available drives, including removable drives.
The autorun.inf file is detected as Worm.Win32.AutoRun.dms.
The autorun.inf appears as:
- [AutoRun]
open=RUNAUT~1\autorun.pif
shell\1=´ò¿ª(&O)
shell\1\Command=RUNAUT~1\autorun.pif
shell\2\=ä¯ÀÀ(&B)
shell\2\Command=RUNAUT~1\autorun.pif
shellexecute=RUNAUT~1\autorun.pif
To make sure it will only run once, the mutex "Red_Server_2007" is created.