Backdoor:W32/Simda

Classification

Malware

Backdoor

W32

Backdoor:W32/Simda.[variant], Backdoor.Simda.[variant], Trojan.Simda.[variant], Simda.[variant]

Summary

Backdoor:W32/Simda is a large family of malware that, once installed on a machine, can be remotely controlled by an attacker to perform various actions, most commonly stealing personal or system data, taking screenshots and downloading additional files onto the system. Infected machines are collected into a botnet.

Removal

Automatic action

Based on the settings of your F-Secure security product, it will either move the file to the quarantine where it cannot spread or cause harm, or remove it.

Manual removal

Some Simda variants will drop a copy of its malicious file as a randomly-named file (e.g., o7oceiq.exe or s93sk.exe) to the root of the %APPDATA% folder. In some cases, users may need to manually delete this file and reboot their system in order to remove all traces of the malware from their machine.

Vulnerability Protection

The vulnerabilities leveraged by Simda malware (and the exploit kits used to deliver the malware) are usually application or platform specific; in other words, a specific program (or even a specific version of a particular program) must be installed on the machine in order for the exploit to be effective.

To prevent exploitation of such vulnerabilities, please refer to the application vendor for the latest updates and additional advice.

Suspect a file is incorrectly detected (a False Positive)?

A False Positive is when a file is incorrectly detected as harmful, usually because its code or behavior resembles known harmful programs. A False Positive will usually be fixed in a subsequent database update without any action needed on your part. If you wish, you may also:

  • Check for the latest database updates

    First check if your F-Secure security program is using the latest detection database updates, then try scanning the file again.

  • Submit a sample

    After checking, if you still believe the file is incorrectly detected, you can submit a sample of it for re-analysis.

    NOTE If the file was moved to quarantine, you need to collect the file from quarantine before you can submit it.

  • Exclude a file from further scanning

    If you are certain that the file is safe and want to continue using it, you can exclude it from further scanning by the F-Secure security product.

    Note You need administrative rights to change the settings.

Find out more

Knowledge Base

Find the latest advice in our Community Knowledge Base.

User Guide

See the user guide for your product on the Help Center.

Contact Support

Chat with or call an expert for help.

Submit a sample

Submit a file or URL for further analysis.

Technical Details

Backdoor:W32/Simda was first seen in 2009, and has since rapidly expanded into a large family of malware with a wide range of capabilities. Early variants focused primarily on stealing passwords and other data from infected machines. In 2013, Simda was reportedly found being used as a banking trojan (primarily targeting banks in Russia and Europe).

Since then, Simda has been used by cybercriminals to rope infected machines into a botnet, with the operators behind it selling access to the affected computers. In April 2015, the Simda botnet was targeted in a coordinated international takedown operation.

Installation

Simda variants are typically distributed via compromised sites that redirect users to websites hosting exploit kits, which deliver the malware onto systems containing vulnerabilities the kits are able to exploit.

When executed on a machine, Backdoor:W32/Simda will install a copy of itself, then delete the original file.

During installation, some Simda variants include routines to check for the presence of virtual machines, sandboxes, debugging programs or network traffic analysis tools (essentially, programs that are often used by security researchers); if found, the malware will delete itself. This check allows the malware to evade systems that could potentially spot the infection in progress.

Some variants search for and stop processes related to anti-malware or security programs, in order to protect its own processes from identification. Some also monitor the web sites being visited on the machine and block access to sites related to security vendors.

Information harvesting

If successfully installed, Simda will hook into various APIs in order to capture various types of data, depending on the specific variant involved. Data captured may include network and machine information, online banking and shopping details, email credentials, browser history details, screenshots and so on.

Some Simda variants will open a port on the infected machine to give a remote attacker direct control. Most variants will also contact a remote command and control (C&C) server to retrieve instructions from the attacker. Data collected from the machine may also be forwarded to the C&C server.

Privilege escalation

If the affected account is not already logged in as administrator, some Simda variants will attempt to log in as an administrator, using a list of common passwords.

Other variants will try to exploit vulnerabilities present (CVE-2010-0232, MS10-092, MS10-015) in order to gain more privileges on the machine, which would allow it to perform a greater range of actions.

Simda botnet takedown

On 13 April 2015, a coordinated takedown involving the Dutch National High Tech Crime Unit (NHTCU), the American Federal Bureau of Investigations (FBI), the Russian Ministry of the Interior’s Cybercrime Department "K", INTERPOL National Central Bureau and certain antivirus firms conducted a series of raids that physically seized 10 servers used to control the Simda botnet.

The removal of the C&C servers removed the ability of the operators to issue commands to machines in the botnet; the individual machines however remain infected. Users of these machines are therefore urged to run a trusted antivirus program to disinfect their systems of the infection in order to be protected from future misuse.

For more information, see: