Researchers from Trend Micro say they have discovered, a new backdoor family that is currently being installed using Java exploits delivered via drive-by downloads or compromised web sites.
The new backdoor family has been named BLYPT by Trend Micro, because of its use of binary large objects (blob) stored in the registry, as well as encryption.
According to the security firm, BLYPT enables an attacker to send commands to an affected system, such as:
• Receive updated DLL binary
• Receive updated configuration
• Receive HTTP request commands, such as Send GET requests to http://103.31.186.19:1000/FetchIP.aspx to retrieve public IP of affected machine
The servers behind these attacks are mainly centered in Romania and Turkey, while the threat is primarily hitting consumers in the United States, Trend said.
“In one case, we found a Java exploit that was used to spread this attack. This particular exploit, detected as JAVA_EXPLOYT.HI, can be used to run arbitrary code,” Trend Micro’s Maharlito Aquino noted in a blog post. “It exploits a vulnerability, CVE-2013-1493, that has been exploited since February 2013. It was patched in March.”
According to Maharlito, the exploit is used to download an installer, which then downloads and installs the main BLYPT component onto the affected system.
“It is named logo32.pngor logo64.png, depending on whether the user is running a 32-bit or 64-bit version of Windows, respectively,” Maharlito explained. “The installer attempts to connect to three servers every 3 seconds, until it successfully downloads the backdoor component. If it fails, it will retry up to 32 times before it gives up.”
The installer was also developed to provide instant feedback on the status of the install by accessing a URL on a malicious server, which serves as a status report.
Trend said it has identified two BLYPT variants, which can be identified based on the file name used to save the main BLYPT component. Both variants have 32- and 64-bit versions, and their behavior is mostly identical, though the location of where their C&C server information is stored is different.
Both variants encrypt their information using alleged (arc4) and use “http://microsoft.com” as the decryption key, Trend Said.
More details from Trend Micro are available here.