Threat behavior
Backdoor:Win32/CoreFlood.A is a detection for older variants of
Win32/Afcore backdoor trojan family. This trojan connects to a command and control (C&C) remote server to retrieve commands that are executed on the affected computer.
Installation
When run, the trojan drops the following files that are also detected as Backdoor:Win32/CoreFlood.A:
%windir%\system32\<random>.exe - trojan "loader", loads DLL component
%windir%\system32\<random>.dll - main trojan component, loaded by EXE component
%temp%\<random>.dll - copy of DLL component
where <random> is six to seven random characters created by a pseudo random generator that is based on system time, for example "qxomke.dll". The registry is modified to run the trojan loader at each Windows start.
In subkey: HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Sets value: "<random>"
With data: "%windir%\system32\<random>.exe"
After installation, the trojan checks if the DLL component is present in the same directory as the loader. If the DLL does not exist, the trojan locates the file stored as "%temp%\<random>.dll" and executes its code.
Payload
Communicates with C&C server
Backdoor:Win32/CoreFlood.A connects to a hard-coded C&C server to receive and execute commands. The trojan may function as a proxy and may download and execute other malware on the affected system.
The EXE component functions as a loader of the embedded DLL. The DLL component exports one function named "init()" to perform its malicious routines. After loading the DLL, the init() export function is called which performs the following actions:
-
creates an event object based from a string date that is hard-coded, for example "APCORE 08/27/03 19:36:10"
-
connects to a master C&C server - when connecting to the server, the trojan appends the current system date and time to the URL, for example:
<site>/bn/ap.txt?2011-01-06%2011%3A42%3A5
In the wild, one example of this trojan connected to a site named "smart2com.net". Other data may be sent to the C&C server.
Analysis by Rex Plantado
Prevention