Backdoor:W32/Simda

Classification

Category:

Malware

Platform:

W32

Type:

Backdoor

Aliases:

Backdoor:W32/Simda.[variant]
Backdoor.Simda.[variant]
Trojan.Simda.[variant]
Simda.[variant]

Summary

Backdoor:W32/Simda is a large family of malware that, once installed on a machine, can be remotely controlled by an attacker to perform various actions, most commonly stealing personal or system data, taking screenshots and downloading additional files onto the system. Infected machines are collected into a botnet.

Removal

Technical Details

Backdoor:W32/Simda was first seen in 2009, and has since rapidly expanded into a large family of malware with a wide range of capabilities. Early variants focused primarily on stealing passwords and other data from infected machines. In 2013, Simda was reportedly found being used as a banking trojan (primarily targeting banks in Russia and Europe).

Since then, Simda has been used by cybercriminals to rope infected machines into a botnet, with the operators behind it selling access to the affected computers. In April 2015, the Simda botnet was targeted in a coordinated international takedown operation.

Installation

Simda variants are typically distributed via compromised sites that redirect users to websites hosting exploit kits, which deliver the malware onto systems containing vulnerabilities the kits are able to exploit.

When executed on a machine, Backdoor:W32/Simda will install a copy of itself, then delete the original file.

During installation, some Simda variants include routines to check for the presence of virtual machines, sandboxes, debugging programs or network traffic analysis tools (essentially, programs that are often used by security researchers); if found, the malware will delete itself. This check allows the malware to evade systems that could potentially spot the infection in progress.

Some variants search for and stop processes related to anti-malware or security programs, in order to protect its own processes from identification. Some also monitor the web sites being visited on the machine and block access to sites related to security vendors.

Information harvesting

If successfully installed, Simda will hook into various APIs in order to capture various types of data, depending on the specific variant involved. Data captured may include network and machine information, online banking and shopping details, email credentials, browser history details, screenshots and so on.

Some Simda variants will open a port on the infected machine to give a remote attacker direct control. Most variants will also contact a remote command and control (C&C) server to retrieve instructions from the attacker. Data collected from the machine may also be forwarded to the C&C server.

Privilege escalation

If the affected account is not already logged in as administrator, some Simda variants will attempt to log in as an administrator, using a list of common passwords.

Other variants will try to exploit vulnerabilities present (CVE-2010-0232, MS10-092, MS10-015) in order to gain more privileges on the machine, which would allow it to perform a greater range of actions.

Simda botnet takedown

On 13 April 2015, a coordinated takedown involving the Dutch National High Tech Crime Unit (NHTCU), the American Federal Bureau of Investigations (FBI), the Russian Ministry of the Interiors Cybercrime Department "K", INTERPOL National Central Bureau and certain antivirus firms conducted a series of raids that physically seized 10 servers used to control the Simda botnet.

The removal of the C&C servers removed the ability of the operators to issue commands to machines in the botnet; the individual machines however remain infected. Users of these machines are therefore urged to run a trusted antivirus program to disinfect their systems of the infection in order to be protected from future misuse.

For more information, see:

More Support

Community

Ask questions in our Community.

User guides

Check the user guide for instructions.

Contact Support

Chat with with or call an agent.

Submit a Sample

Submit a file or URL for analysis.