Win32.DKS.E (Ca.com)

Description Published: August 29, 2004
Description Modified: September 2, 2004

Category:          Win32
Also known as: BackDoor-CGT (McAfee),
                          Win32/DKS.E.Trojan, Trojan.Win32.Genme.c (Kaspersky),
                          Backdoor.Xebiz (Symantec)

Description

Win32.DKS.E is a trojan that opens a SOCKS 5 proxy on an affected machine.

Method of Infection

When executed, Win32.DKS.E copies itself to %System%ss.exe (size: 15,360 bytes) and drops the following files into the %System% directory:

* SS.dat (size: 15,360 bytes) - an encrypted copy of itself
* Dss.dll (size: 3,072 bytes)
* Dssa.dll (size: 3,072 bytes)

It then edits the registry so that the dll is loaded when Explorer is started:

HKLMSOFTWAREMicrosoftWindowsCurrentVersionShellServiceObjectDelayLoadss = {Generated CLSID}
HKCRCLSID{Generated CLSID}InProcServer32Default = ˝dssa.dll˝

Note: ´%System%´ is a variable location. The trojan determines the location of the current System folder by querying the operating system. The default installation location for the System directory for Windows 2000 and NT is C:WinntSystem32; for 95,98 and ME is C:WindowsSystem; and for XP is C:WindowsSystem32.

The dlls are used to execute %System%ss.exe each time they are called and to restore the backup (ss.dat) if the original executable is missing. The dlls also ensure that that ss.exe runs continuously. Should the program be terminated, the dlls will re-execute this file.

The trojan creates the mutex ´one´ in order to ensure that only one copy of trojan is running at any time.

Note: Computer Associates have received several reports of this trojan from users who were previously compromised by variants of the VBS.Suzer Family - a group of trojans that attempt to exploit vulnerabilities in Internet Explorer in order to install other trojans. Please visit the VBS.Suzer Family description elsewhere in our encyclopedia for further detail.

Payload

SOCKS Proxy/Backdoor Functionality

Initially, DKS.E obtains the location of IEXPLORE.EXE by sampling the registry entry:

HKLMSoftwareMicrosoftWindowsCurrentVersionApp PathsIEXPLORE.EXE

and contacts a particular site using a predetermined IP address presumably to notify its controller of a new system compromise and supply the affected machine´s IP address and a randomly generated port number above 1080.

It then opens up a Socks 5 proxy with no authentication on the port number that was sent to the site. Proxies can be used to redirect network traffic through the affected system, for example, to hide the true source of malicious activity on the Internet.

Analysis by Matthew McCormack

More information on CA Virus Information Center:
http://www3.ca.com/securityadvisor/virusinfo/virus.aspx?id=40036

Computer Associates – the Trusted Source of Security Knowledge