BackDoor.Logtu.1

Packer: absent

Compilation date:
11.01.2018 12:16:21 (x86 version)

SHA1 hash :

• 7797107eb4a9a9e4359413c15999603fa27714b3

Description

A multifunctional backdoor trojan for 32-bit and 64-bit Microsoft Windows operating systems. It represents an executable library written in C++. It uses vector classes and strings from the STL library (Standard Template Library). The main function of the trojan is to obtain unauthorized access to infected computers and perform malicious actions at attackers’ commands.

Operating routine

The library contains the following exporting functions:

ServiceMain
mymain

The mymain carries the main functionality of the trojan.

mymain function

When called, this function uses GetTempFileNameW to generate the name of the temporary file with the rar prefix and opens it for writing. This file is used as a journal. Writing to the journal is performed in the following format:

[%d-%02d-%02d %02d:%02d:%02d] %d %d\n%s\n\n" => "[YYYY-MM-DD HH:MM:SS] <rec_id>
<error_code>\n<record>\n\n

where:

• rec_id — is a record type ID;
• error_code — error code (in most cases, it has a 0) value; if an error occurs during execution, the GetLastError() or WSAGetLastError() value is written;
• record — additional data.

Before it is added to the journal, the written data is encoded with the XOR operation, using the 0x31 byte. The rec_id table of ID values is listed at the end of this description.

Next, the trojan collects the following information about the infected system:

 
struct sysinfo
{
DWORD dword_0;
DWORD is_VMWare;
WCHAR str_test[8]; //возможно ID
DWORD dword_1;
BYTE user_name[64];
BYTE gap_0[64];
WCHAR host_IP[20];
DWORD osver_Major;
DWORD osver_Minor;
DWORD uiANSI_CP;
DWORD uiOEM_CP;
WCHAR host_name[15];
BYTE gap_1[98];
BYTE user_SID[128]; //string SID
DWORD osver_ProductType;
BYTE is_Wow64process;
BYTE mac_address[12];
BYTE gap_2[3];
DWORD number_of_processors;
DWORD total_phys_mem_MBytes;
};

It then checks that the library runs inside the VMWare virtual machine environment. If it detects a virtual machine, the corresponding information is added to the collected system data, while the trojan continues to run.

There is a list of several C&C server addresses encoded inside the source code of the BackDoor.Logtu.1. They are encrypted with the XOR, using the 0x11 byte. However, only the first address from that list is used to control the backdoor. See this list below:

104.194.215[.]199;
192.168.1[.]115;
www.test[.]com.

Moreover, the trojan stores an array of ports within which each element corresponds to one of the servers above:

443, 443, 80

BackDoor.Logtu.1 has an option to use a proxy server, but the analyzed sample lacks such an address. If the proxy server address is present, it is also encoded byte by byte with the XOR operation, using the 0x11 byte.

After the initial preparation, the trojan launches the cycle of connections to the C&C server through the TCP socket. Within the first connection, BackDoor.Logtu.1 tries to directly connect to the server. If it fails, it uses an HTTP proxy server if its address is encoded into the body of the trojan. If it wasn’t successful, the trojan extracts the proxy server parameters from the HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyServer registry key and tries to establish the connection. . In case of another failure, the backdoor tries to obtain the proxy server information through the WinHTTP API, sending the google[.]com request via the WinHttpGetProxyForUrl function. If this attempt has also failed, BackDoor.Logtu.1 tries to extract the corresponding settings from the HKU\<session_user_SID>\...\ProxyServer registry key. . This cycle repeats until the trojan is successfully connected to the server.

After successfully connecting, BackDoor.Logtu.1 sends the information about the infected system to the server. The data transfer and response receipt is divided into two stages:

• sending the packet with the length of the payload;
• sending the payload itself.

The value of the packet with the length of 4 bytes equals <payload_len>+4. This is because the packet with the payload contains a 4 bytes prefix, which in turn, contains the payload ID. Consequently, the payload has the format as shown below:

struct payload
{
DWORD payload_id;
BYTE payload[payload_len];
}

The data transferred from the trojan to the server, as well as its response, are encrypted with the RC4 algorithm. The encryption key is stored inside the trojan body as a separate string, but calculates using the following algorithm:

from hashlib import md5
password = "123456"
salt = md5("").hexdigest()
key = md5(password + salt).hexdigest()

The ID of the packet with the system information has a value of 0.

After the system information is sent and the trojan receives the response from the server, it launches a thread that sends heartbeats every minute. Their ID has a value of 1 and the payload length has a value of 0. After 10 packets are sent, the server connection closes and reestablishes again.

The backdoor waits for the server reply with the packet with the length value that should not exceed 0x1F40. Next, it waits for the packet itself, which contains the command as a payload. After this packet is decrypted, it checks the value of the first DWORD, which is the command ID. The ID value should not exceed 0x34.

In some cases, the command contains additional parameters presented in the form of the strings split with the | symbol. The structure of this command has the form of the "param_0"|"param_1"|...|"param_n".

The list of commands that the trojan can receive and execute is shown in the table below:

        struct process_info
        {
        WCHAR proc_name[30];
        DWORD PID;
        DWORD parent_PID;
        WCHAR self_module_path[260]
        }
        

          struct disk_info
          {
          DWORD root_path;
          DWORD dword_0;
          DWORD type;
          DWORD dword_1;
          DWORD cdrom_or_removable;
          }
        

        struct tunnel_host
        {
        WORD index;
        char hostname[66];
        DWORD port;
        }
        

        struct tunnel_data
        {
        WORD index;
        char buffer[];
        }
        

Upon receiving the command with the 0x17 ID, the trojan closes the file handler, which is stored in the global variable. This file is used only twice: once upon receiving the command, specified earlier, and once in the journal writing function.

File handler closing:

Writing to the journal (logging):

Table of the identifiers of the log entries types