Win32/Bafruz

Win32/Bafruz is a multi-component family of backdoor trojans that can perform a number of different actions on your computer, such as:

• Uninstall antivirus and security products
• Intercept social media webpages such as Facebook and Vkontakte in order to hijack conversations
• Install Bitcoin mining software
• Perform denial of service attacks

Bafruz communicates with other Bafruz-infected computers via a peer-to-peer (P2P) protocol in order to update and download its components onto your computer.

Installation

Win32/Bafruz consists of a number of different executable components, each component responsible for the backdoor's different payloads. Once a Bafruz component is running on your computer, it may download its other components from other Bafruz infected computers connected through a P2P network.

The different components have been observed using file names such as those listed below:

• btc_server.exe
• client_8.exe
• ddhttp.exe
• gbot_loader.exe
• iecheck12.exe
• loader2.exe
• loader_rezerv.exe
• udp.exe
• w_distrib.exe

Depending on the component running on your computer, Win32/Bafruz may install itself in a number of different ways. The following are file locations that the different Bafruz components have been known to copy themselves to:

• %windir%\l1rezerv.exe
• %windir%\services32.exe
• %windir%\sysdriver32.exe
• %windir%\sysdriver32_.exe
• %windir%\systemup.exe
• %windir%\update<number>\svchost.exe
• %windir%\update<number>\svchostdriver.exe

Bafruz may also create registry entries in order to execute these copies at each Windows start. For instance, the following are registry entries observed being created by the different Bafruz components:

In subkey: HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Sets value: "sysdriver32.exe"
With data: "%Windows%\sysdriver32.exe" rezerv

In subkey: HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Sets value: "sysdriver32_.exe"
With data: "%Windows%\sysdriver32_.exe" rezerv

In subkey: HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Sets value: "wxpdrv"
With data: "%Windows%\services32.exe"

In subkey: HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Sets value: "l1rezerv.exe"
With data: "%Windows%\l1rezerv.exe"

In subkey: HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Sets value: "systemup"
With data: "%Windows%\systemup.exe"

Additional files may also be created by the various Bafruz components as a part of its payload, for instance:

%windir%\proc_list1.log - contains list of processes executing on your computer

Payload

Removes antivirus products

One of the Win32/Bafruz components is used to uninstall certain antivirus or security products that may be running on your computer. It does this by checking for processes that may be running that are known to be used by these antivirus products. It targets the following products:

If any of the abovelisted products are found, Win32/Bafruz displays the following alert warning you that a virus was detected on your computer, and a reboot is required to remove it:

If you reboot your computer, Win32/Bafruz ensures that it starts in safe mode and uninstalls the antivirus or security product that is installed on your computer. It then displays a fake alert in the taskbar informing you that the security product that has been uninstalled is now running in enhanced protection mode. For example, the following is an alert displayed after Bafruz has uninstalled Microsoft Security Essentials:

Downloads and executes files

Win32/Bafruz is able to communicate with other Bafruz infected computers in order to download additional components onto your computer. It contains a list of hardcoded servers and IP addresses that it connects to in order to obtain a list of peers connected to the Peer-to-Peer (P2P) network. Some of the servers it may contact include the following:

• bmp-forwindows.com
• chrome-update.ru
• drivers-z2012.com
• free-dns-server1.com
• free-pac.net
• my-dns-lists.com
• newdrivers-win7.com
• office-important-update.com
• supercarsinfo.net
• torrents-list-srv.com

The requests made to these servers are commonly in the following format:

hxxp://<server>/distrib_serv/ip_list.php

Through the network, it can also obtain a list of URLs that point to additional components to download. Most of these components belong to the Bafruz family and are used to perform the backdoor's different payloads. Additionally, Bafruz has been observed downloading TrojanDropper:Win32/Sirefef.B into the computer using the following file name:

gbot_loader.exe

Modifies security settings

Some of the Win32/Bafruz components may add themselves to the list of applications that are authorized to access the Internet without being stopped by the Firewall. For example, the following registry modification may be made:

In subkey: HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
Sets value: "%Windows%\update<number>\svchost.exe"
With data: "%Windows%\update<number>\svchost.exe:*:enabled:%Windows%\update<number>\svchost.exe"

Win32/Bafruz may also download a file with the name "resetsr.exe" that modifies the System Restore option in Windows by modifying the following registry entry:

In subkey: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore
Modifies value: "DisableSR"
With data: "0"

Mines Bitcoins

Two of the Win32/Bafruz components, using the file names btc_server.exe and client_8.exe, are primarily used to perform Bitcoin mining on your computer; this could potentially allow unauthorized use of your computer's resources to generate Bitcoins.

The btc_server.exe component is used as a Bitcoin server that listens for incoming traffic from other peers performing Bitoin mining. The client_8.exe component downloads a number of Bitcoin mining applications onto your computer in order to perfrom the mining, including the following:

• phoenix.exe (Phoenix miner)
• rpcminer-cpu.exe (RPC miner)
• ufa.exe   (Ufasoft miner)

The server component will also attempt to terminate any existing Bitcoin server that is running on the computer by terminating the following processes:

• bitcoin.exe
• bitcoind.exe
• namecoind.exe

Perform denial of service attacks

Win32/Bafruz is capable of performing Distributed Denial of Service (DDoS) attacks against a list of websites it obtains from its control servers. Through the components udp.exe and ddhttp.exe, Bafruz downloads a list of sites that it can then perform DDoS attacks against using the UDP and HTTP protocols.

Intercepts social networking traffic

Win32/Bafruz is capable of intercepting login information that you enter when you visit social networking sites such as Facebook and Vkontakte. Using these credentials, Win32/Bafruz can then send messages or post links to your friends and contacts. Bafruz intercepts this login information by creating a proxy server on the local host and directing Facebook and Vkontakte traffic through this proxy. Bafruz does this by adding to the Hosts file, found in file location "<system folder>\drivers\etc\hosts" the following list of social networking websites:

Note: <system folder> refers to a variable location that is determined by the malware by querying the operating system. The default installation location for the System folder for Windows 2000 and NT is C:\Winnt\System32; and for XP, Vista, and 7 is C:\Windows\System32.

Additional information

A number of registry entries may be created by the different components of Bafruz in which to store version information or for the malware families own use, for example:

In subkey: HKLM\SOFTWARE\btcclient
Sets value: "ver"
With data: ""<number>" for example, 1.62
Sets value: "close"
With data: "0" or "1"
Sets value: "mainer_cmd"
With data: "0"

In subkey: HKLM\SOFTWARE\systemdrv64
Sets value: "close"
With date: "0"
Sets value: "currentsptime"
With data: "0"
Sets value: "time"
With date: <value>

Analysis by Amir Fouda