Backdoor:Win32/Parcim.A

Installation

When run, this threat creates the following files: 

• %windir%\Temp\IEINFO06.OCX
• %windir%\Temp\TS_78FD9.tmp

It copies iteslf to %TEMP%\Perflib_Perfdata_99c.dat.

It modifies the following registry entries to install itself as a browser helper object (BHO) in Internet Explorer:

In subkey: HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{889D2FEB-5411-4565-8998-1DD2C5261283}
Sets value: "(Default)"
With data: "XunleiBHO" 

Spreads via

We have seen Backdoor:Win32/Parcim.A spread in an email attachment as a malicious PowerPoint or Word document.

Payload

Opens a socket and wait for commands

Backdoor:Win32/Parcim.A binds itself to TCP port 1139. It opens a socket and waits for further commands from an attacker.

Downloads components 

When it receives the command to download a file it contacts the following server:

• http://www.okaairport.com/<removed>/Nfile.asp 

It saves a file, that is most likely other malware, as C:\Windows\Temp\MSCALL.OCX.

At the time of analysis this server was not contactable.

Collects information 

We have seen this threat collect information about your computer, such as your IP address, hostname, and the port it used to contact the remote server.

Analysis by Alden Pornasdoro.