You also want an ePaper? Increase the reach of your titles
YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.
Decoy documents used by the “e4004c1f” variant include a Korean text on the LDAP protocol.<br />
Apart from the similarities with other malware established in the publications mentioned above, this variant has<br />
been distributed in a particular installer which includes the backdoor in an embedded password-protected zip<br />
archive. The password for this zip archive is “!1234567890 dghtdhtrhgfjnui$%^^&fdt” - identical to the password<br />
used by Destover “Volgmer” backdoors already detailed in this paper. There are also code similarities with Volgmer<br />
elsewhere – for example, the function to declare network API’s from ws2_32.dll is identical, and the API names are<br />
encoded using the same API obfuscation scheme.<br />
The C&C configuration can be hardcoded, or stored in a data file and subkeys under the registry key<br />
HKLM\SYSTEM\CurrentControlSet\Control\WMI\Security.<br />
Some variant A samples uses subkey a57890bc-ca23-3453-a23c-d385e9058fdf<br />
Some variant C samples uses subkey 821d1af-7a08-4b06-81cd-869365cdf713
Change language