Win32/Sensode

Installation

This threat can be downloaded or dropped by other malware including Win32/Mdmbot, Win32/Moudoor, Win32/Plugx, Win32/Sensode, and Win32/Derusbi.

The threat is dropped as a DLL file, usually into the <system folder> or the folder where the parent malware is run from.

The name of the file is random, but it might use characters or a string from the parent malware's file name.

It modifies the registry so that it runs each time you start your PC.

In subkey: HKLM\SYSTEM\CurrentControlSet\Services\<variable service name>\Parameters\
Sets value: "ServiceDll"
With data: "<malware filepath>.dll"

It searches the registry for existing service names, and will use the first name that it finds. Some variants will also apply certain lookup rules to create the service name; this means the service name varies widely between samples.

Payload

Contacts a remote host

We have seen this threat connect to newss.effers.com to send information about your PC to a remote hacker, including:

• Available RAM
• IP address
• OS version.

It tries to connect to kr.chongzi.kr using ports 21, 25 and 53. A malicious hacker can then instruct it to:

• Change the firewall policy
• Collect information about your PC
• Run files
• Share the opened shell with someone else
• Transfer files through a specific URL or an FTP server
• Uninstall the backdoor.

Analysis by Mathieu Letourneau