Backdoor:Win32/Haxdoor.gen!B is a generic detection for the
Haxdoor family of backdoors. It may open certain ports to wait for commands from a remote attacker.
Installation
Upon execution, Backdoor:Win32/Haxdoor.gen!B drops the following files in the system:
- <system folder>\z98.bin - detected as Backdoor:Win32/Haxdoor
- <system folder>\java2.sys - detected as Backdoor:Win32/Haxdoor; this file contains rootkit functionality to hide Haxdoor.gen!B in the infected system
- <system folder>\snjava.dll - detected as Backdoor:Win32/Haxdoor.gen!B
Note - <system folder> refers to a variable location that is determined by the malware by querying the Operating System. The default installation location for the System folder for Windows 2000 and NT is C:\Winnt\System32; and for XP and Vista is C:\Windows\System32.
It then loads 'snjava.dll' using 'rundll32.exe'. It also modifies the system registry so that it runs every time Windows starts:
Adds value: "DllName"
With data: "snjava.dll"
To subkey: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\snjava
It creates a mutex named 'stpmutexok' to ensure that only one instance of it is running.
Payload
Modifies Firewall Settings
Backdoor:Win32/Haxdoor.gen!B bypasses the Windows firewall by adding an entry to the following registry subkey:
HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
It also ensures that its dropped rootkit component starts even in Safe Mode by adding the following registry subkeys:
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\java2.sys
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\java2.sys
It also registers its rootkit component as a service by creating the following subkey:
HKLM\SYSTEM\CurrentControlSet\Services\java2
Backdoor Functionality
Depending on the sample, Backdoor:Win32/Haxdoor.gen!B may open and listen in to certain TCP ports (such as TCP port 6051 and 6052) for commands to perform certain functions, such as to download, drop, and execute other files.
It may also connect to a Web site via HTTP, such as 'rushserver.net'.
Analysis by Andrei Florin Saygo