Eng
  1. Skip to navigation
  2. Skip to content
  3. Skip to sidebar


Backdoor:W32/PcClient.VK


Aliases:


Backdoor.Pcclient, Backdoor.Win32.PcClient
Backdoor:Win32/PcClient (Microsoft)
BKDR_PCCLIENT.VK (Trend Micro)
Backdoor.Formador (Symantec)

Malware
Backdoor
W32

Summary

A remote administration utility which bypasses normal security mechanisms to secretly control a program, computer or network.



Disinfection & Removal

Automatic Disinfection

Allow F-Secure Anti-Virus to disinfect the relevant files.

For more general information on disinfection, please see Removal Instructions.



Technical Details

Backdoor:W32/PcClient.VK is seen in the wild as the payload file installed on a host machine by a specially crafted Microsoft PowerPoint file that contains exploit code.

When run, PcClient.VK attempts to hide processes, files, registry data and network connections, allows the attacker to perform arbitrary actions on machine, and steals sensitive information from an infected computer.


Installation

Once execution of PcClient.VK been initiated, its executable component will drop the following hard-coded files in the Windows System directory:

  • Ybrcuugm.d1l - Backdoor
  • Ybrcuugm.dll - Keylogger

Note: the file size of Ybrcuugm.d1l might vary due to garbage code appended at the end of the file.

It will also drop the following driver that will communicate with the dll files in order to hide the malware's processes, registry entries and files:

  • %sysdir%\drivers\Ybrcuugm.sys

Moreover it also hides some network traffic that the PcClient.VK uses.


Payload

Part of the malware's payload is that is logs all the keystrokes made by the user and saves it to the following file:

  • %sysdir%\log.txt

It then sends this file to a remote hacker.


Backdoor

The malware's backdoor routine is injected into svchost.exe, which is capable doing the following:

  • updating itself
  • remote execution

This malware connects to the following site:

  • http://baas.8866.org/[BLOCKED]ex.asp

Registry

It modifies the following known registry entry as its autostart technique:

Data before:

  • [HKLM\SYSTEM\CurrentControlSet\Services\dmserver\Parameters] ServiceDll = %sysdir%\dmserver.dll

Data after:

  • [HKLM\SYSTEM\CurrentControlSet\Services\dmserver\Parameters] ServiceDll = %sysdir%\Ybrcuugm.d1l

In order for the system to work normally, Ybrcuugm.dll will execute its malicious routine and then pass the correct parameter to the original dmserver.dll.

It also adds the following autostart registry entry for the driver:

  • [HKLM\System\ControlSet001\Services\Ybrcuugm] ImagePath= C:\WINDOWS\system32\drivers\Ybrcuugm.sys






Submit a sample




Wondering if a file or URL is malicious? Submit a sample to our Lab for analysis via the Sample Analysis System (SAS)

Give And Get Advice




Give advice. Get advice. Share the knowledge on our free discussion forum.

Scan and clean your PC




F-Secure Online Scanner will scan and clean your PC in just a few minutes for free