Name :	Haxdoor.KI
Size:	54804
Category:	Trojan
Type:	Backdoor
Platform:	Win32
Date of Discovery:	August 17, 2006

Haxdoor.KI - On the 17th of August 2006 we received numerous reports of a new Haxdoor backdoor variant being spammed as an e-mail attachment to a large amount of people. The backdoor was spammed inside an archive named rakningen.zip. The backdoor's file, located inside the archive, is named rakningen.exe. (Swedish) We also have a report that it was spammed inside an archive named rechnung.zip as rechnung.exe. (German)

Haxdoor is a powerful backdoor with rootkit and spying capabilities. It can hide its presence, processes and files, on an infected system. So when it is active, it can only be detected by anti-virus programs that use kernel drivers and by rootkit detectors such as our F-Secure BlackLight. It can also be detected by F-Secure products that have a built-in anti-rootkit engine such as our F-Secure Internet Security 2006.

Update - August 25th:

The skyinet.info website, located in Russia, that the backdoor connects to, is now offering a URL that points to a file named samki.exe. This file contains a nasty payload that damages Windows beyond repair. This file can be downloaded and launched by a hacker to destroy all infected computers when the time comes. We have added detection for the payload file into the 2006-08-25_04 update.

HaxDoor.KI was spammed to a large amount of people in e-mail messages with the following characteristics:

Swedish Language
Subject:


Message Body:


Screenshot:


Attachment:


We also have a report that it was spammed as rechnung.exe inside an archive named rechnung.zip attached to a message in German.


German Language
Subject:


Message Body:


Screenshot - German Language:


Attachment:



Installation to the System

When the backdoor's file (rechnung.exe or rakningen.exe) is run, it silently drops 5 files to the Windows System folder:



The DLL files are identical to each other, as are the SYS files. During its operation the backdoor creates several different files where it stores stolen data. Those files are encrypted.


When the backdoor is active, all its files are hidden with the help of rootkit techniques. Also, if the backdoor injected its code into the Windows Explorer process, it hides the Explorer.exe process. Otherwise if the backdoor started as a component of the Winlogon process, usually after a system reboot, it hides the Winlogon.exe process. Our BlackLight Rootkit Eliminator as well as F-Secure products that have an anti-rootkit engine, for example F-Secure Internet Security 2006, can detect and remove the backdoor successfully.


The DLL files represent the main backdoor's components. To make sure that the backdoor is started every time Windows boots, the Winlogon Notification key for the backdoor's "xopptp.dll" file is added into the Registry:



This allows the backdoor to start even before a user logs on. Also the backdoor's driver, a file named xdpptp.sys, is registered as a system driver to be loaded even in the minimal configuration (Safe Boot):



In addition, the backdoor's driver can be registered as a service with the following attributes:


- Where %WinSysDir% represents Windows System directory
(usually C:\Windows\System32\).


Functionality

It looks like the main purpose of this backdoor, that was created by the virus writer who calls himself 'Corpse', is spying against the users of infected computers. The stolen info, which includes various logins, passwords, on-line payment systems account details and so on, is sent to a hacker, who can (and probably does) sell it to other criminals. At the same time the extensive backdoor capabilities and the set of remote control tools that is offered by the virus writer on a commercial basis, makes this malware suitable for spammers, phishers and other computer criminals.


The backdoor collects and sends the following information to a hacker:



The backdoor can also steal cached MSN, Miranda, ICQ and Webmoney passwords as well as RAS phone numbers and other info related to RAS (username, password, domain, DNS settings).


The backdoor monitors web forms accessed from the infected machine. If the URL or the data inside of the web pages match to a fixed list of online bank-related keywords, then the backdoor will post the content of the form to a server via a web site at the address of skynet.info.


In addition, the backdoor can steal information related to E-Gold, Ebay, and PayPay accounts. These services are widely used for online payments around the world.


Being active, the backdoor injects itself into the processes with the following names:



The backdoor listens on TCP port 16661 for commands from a remote host. A hacker can connect to that port and control the backdoor's behaviour. The backdoor allows a hacker to do any of the following:



The backdoor also starts a command shell (cmd.exe) listening on TCP port 16016.


Payload

The backdoor blocks connections from an infected computer to the following sites that mostly belong to anti-virus vendors:



In addition, Haxdoor.KI terminates the following security-relayed processes:



The backdoor disables the VFILT and WSCSVC services to bypass Outpost and Windows Firewalls.


And finally, the backdoor can modify the following settings of Internet Explorer:



Amusingly, Haxdoor.KI can still play such dumb tricks on a user as opening and closing of CD-ROM tray. This is a heritage from the old time backdoors like Deep Throat, NetBus, SubSeven and others.


Additional Payload

When the backdoor's main component accesses the skyinet.info website with a specially costructed URL, the site offers a URL to a file named samki.exe. This file contains a nasty payload - it renames several files that represent the key Windows components (for example kernel32.dll, explorer.exe and so on) and destroys the Registry database. So after system restart Windows becomes unbootable and damaged beyond repair.