Backdoor:W32/TDSS

Classification

Category :

Malware

Type :

Backdoor

Aliases :

Backdoor:W32/TDSS

Summary

A remote administration tool (RAT) that bypasses the security features of a program, computer or network to give unauthorized access or control to its user.

Removal

Based on the settings of your F-Secure security product, it will either move the file to the quarantine where it cannot spread or cause harm, or remove it.

A False Positive is when a file is incorrectly detected as harmful, usually because its code or behavior resembles known harmful programs. A False Positive will usually be fixed in a subsequent database update without any action needed on your part. If you wish, you may also:

  • Check for the latest database updates

    First check if your F-Secure security program is using the latest updates, then try scanning the file again.

  • Submit a sample

    After checking, if you still believe the file is incorrectly detected, you can submit a sample of it for re-analysis.

    Note: If the file was moved to quarantine, you need to collect the file from quarantine before you can submit it.

  • Exclude a file from further scanning

    If you are certain that the file is safe and want to continue using it, you can exclude it from further scanning by the F-Secure security product.

    Note: You need administrative rights to change the settings.

Technical Details

This malware installs a rootkit onto the system. In addition to hiding its presence on the system, the rootkit is able to inject a dropped file into a process, which is then able to function as a backdoor program.

Installation & Rootkit

During installation, this malware creates a copy of the file %System%\ADVAPI32.DLL as:

  • %Temp%\TDSS%randchar2%.tmp.

It then modifies this file with 21 bytes at the entry point, in order to load the file %Temp%\TDSS%randchar1%.tmp. A number of additional changes must take place for this to occur.

First, the malware deletes the "\KnownDlls\advapi32.dll" section object of the Windows Operating System, in order to remove the legitimate advapi32.dll. The section object is then recreated and linked to the %Temp%\TDSS%randchar2%.tmp file. It then stops and restarts the "MSISERVER" Windows service, which subsequently loads the %Temp%\TDSS%randchar2% file.

The cumulative effect of these changes causes %Temp%\TDSS%randchar1%.tmp to be loaded as a Windows service, which then creates a file, %systemdir%\drivers\TDSServ.sys. This sys file is the actual rootkit driver file. The rootkit hides all its files, as well as registry components beginning with the string 'TDSS'.

The loaded rootkit driver then drops a dll file in the %systemdir% as "TDSSl.dll". It injects the dropped file into SVCHOST.EXE and tries to connects to a number of websites, which are still live at time of writing.

The injected dll can also function as a backdoor, which may be commanded to perform any of the following routines:

  • Download and execute programs
  • Display pop-up advertisements

NOTE:

  • TDSS%randchar1%.tmp is the first temporary file created with random characters added as part of the filename
  • TDSS%randchar2%.tmp is the second temporary file created with different random characters added as part of the filename

File System Changes

Creates these files:

  • %Temp%\TDSS%randchar1%.tmp
  • %Temp%\TDSS%randchar2%.tmp

Process Changes

Creates these mutexes:

  • \TdlStartMutex

Network Connections

Attempts to connect with HTTP to:

  • hxxp://findxproportal1.com/tdss2/[...]/main
  • hxxp://stableclickz1.com/tdss2/[...]/main
  • hxxp://updatemics1.com/tdss2/[...]/main
  • hxxp://findsproportal1.com/tdss2/[...]/main
  • hxxp://findzproportal1.com/tdss2/[...]/main
  • hxxp://91.203.92.121/tdss2/[...]/main
  • hxxp://youblognews.net/tdss/[...]/main

Registry Modifications

The rootkit driver is registered with the key:

  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TDSSserv.sys

It may also create the following registry subkeys:

  • HKEY_LOCAL_MACHINE\SOFTWARE\TDSS\versions
  • HKEY_LOCAL_MACHINE\SOFTWARE\TDSS\injector
  • HKEY_LOCAL_MACHINE\SOFTWARE\TDSS\disallowed
  • HKEY_LOCAL_MACHINE\SOFTWARE\TDSS\connections

The malware creates the following registry entries:

  • HKEY_LOCAL_MACHINE\SOFTWARE\TDSS, build = "standart"
  • HKEY_LOCAL_MACHINE\SOFTWARE\TDSS, type = "clicker"
  • HKEY_LOCAL_MACHINE\SOFTWARE\TDSS, affid = "5"
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\tdssdata, affid = "5"
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\tdssdata, subid = "1"
  • HKEY_LOCAL_MACHINE\SOFTWARE\TDSS, subid = "1"
  • HKEY_LOCAL_MACHINE\SOFTWARE\TDSS, serversdown = [dword value]

A mutex is then created so that only one copy of the malware will reside in memory at any given session.