Backdoor:W32/Simda

Backdoor:W32/Simda was first seen in 2009, and has since rapidly expanded into a large family of malware with a wide range of capabilities. Early variants focused primarily on stealing passwords and other data from infected machines. In 2013, Simda was reportedly found being used as a banking trojan (primarily targeting banks in Russia and Europe).

Since then, Simda has been used by cybercriminals to rope infected machines into a botnet, with the operators behind it selling access to the affected computers. In April 2015, the Simda botnet was targeted in a coordinated international takedown operation.

Installation

Simda variants are typically distributed via compromised sites that redirect users to websites hosting exploit kits, which deliver the malware onto systems containing vulnerabilities the kits are able to exploit.

When executed on a machine, Backdoor:W32/Simda will install a copy of itself, then delete the original file.

During installation, some Simda variants include routines to check for the presence of virtual machines, sandboxes, debugging programs or network traffic analysis tools (essentially, programs that are often used by security researchers); if found, the malware will delete itself. This check allows the malware to evade systems that could potentially spot the infection in progress.

Some variants search for and stop processes related to anti-malware or security programs, in order to protect its own processes from identification. Some also monitor the web sites being visited on the machine and block access to sites related to security vendors.

Information harvesting

If successfully installed, Simda will hook into various APIs in order to capture various types of data, depending on the specific variant involved. Data captured may include network and machine information, online banking and shopping details, email credentials, browser history details, screenshots and so on.

Some Simda variants will open a port on the infected machine to give a remote attacker direct control. Most variants will also contact a remote command and control (C&C) server to retrieve instructions from the attacker. Data collected from the machine may also be forwarded to the C&C server.

Privilege escalation

If the affected account is not already logged in as administrator, some Simda variants will attempt to log in as an administrator, using a list of common passwords.

Other variants will try to exploit vulnerabilities present (CVE-2010-0232, MS10-092, MS10-015) in order to gain more privileges on the machine, which would allow it to perform a greater range of actions.

Simda botnet takedown

On 13 April 2015, a coordinated takedown involving the Dutch National High Tech Crime Unit (NHTCU), the American Federal Bureau of Investigations (FBI), the Russian Ministry of the Interiors Cybercrime Department "K", INTERPOL National Central Bureau and certain antivirus firms conducted a series of raids that physically seized 10 servers used to control the Simda botnet.

The removal of the C&C servers removed the ability of the operators to issue commands to machines in the botnet; the individual machines however remain infected. Users of these machines are therefore urged to run a trusted antivirus program to disinfect their systems of the infection in order to be protected from future misuse.

For more information, see:

• Interpol:INTERPOL coordinates global operation to take down Simda botnet
• The Register (13 Apr 2015): Backdoor bot brains snatched after cops, white hats raid servers