BackDoor.BladabindiNET.10

Technical Information

Modifies file system

Creates the following files

<Current directory>\apk.exe
<Current directory>\tools\zipalign.exe
<Current directory>\tools\testkey.x509.pem
<Current directory>\tools\testkey.pk8
<Current directory>\tools\smali.jar
<Current directory>\tools\signapk.jar
<Current directory>\tools\roptipng.exe
<Current directory>\tools\baksmali.jar
<Current directory>\tools\apktool2.0.0b9.jar
<Current directory>\logs\021420.log
<Current directory>\tools\apktool1.5.2.jar
<Current directory>\tools\adbwinapi.dll
<Current directory>\tools\adb.exe
<Current directory>\tools\aapt.exe
<Current directory>\tools\7za.exe
%TEMP%\20110911\tools.zip
%TEMP%\20110911\list.txt
%TEMP%\20110911\7za.exe
<Current directory>\apk1.exe
<Current directory>\tools\adbwinusbapi.dll
%TEMP%\hsperfdata_user\188

Deletes the following files

%TEMP%\20110911\7za.exe
%TEMP%\20110911\list.txt
%TEMP%\20110911\tools.zip

Network activity

Connects to

'al####i.myq-see.com':25552

UDP

DNS ASK al####i.myq-see.com

Miscellaneous

Searches for the following windows

ClassName: 'EDIT' WindowName: ''
ClassName: 'AutoHotkey' WindowName: '<Current directory>\apk.exe'
ClassName: '#32771' WindowName: ''

Creates and executes the following

'<Current directory>\apk.exe'
'%TEMP%\20110911\7za.exe' x -otools %TEMP%\20110911\tools.zip Frameworks
'%TEMP%\20110911\7za.exe' x -otools %TEMP%\20110911\tools.zip zipalign.exe
'%TEMP%\20110911\7za.exe' x -otools %TEMP%\20110911\tools.zip testkey.x509.pem
'%TEMP%\20110911\7za.exe' x -otools %TEMP%\20110911\tools.zip testkey.pk8
'%TEMP%\20110911\7za.exe' x -otools %TEMP%\20110911\tools.zip smali.jar
'%TEMP%\20110911\7za.exe' x -otools %TEMP%\20110911\tools.zip signapk.jar
'%TEMP%\20110911\7za.exe' x -otools %TEMP%\20110911\tools.zip roptipng.exe
'%TEMP%\20110911\7za.exe' x -otools %TEMP%\20110911\tools.zip apktool2.0.0b9.jar
'%TEMP%\20110911\7za.exe' x -otools %TEMP%\20110911\tools.zip apktool1.5.2.jar
'%TEMP%\20110911\7za.exe' x -otools %TEMP%\20110911\tools.zip baksmali.jar
'<Current directory>\apk1.exe'
'%TEMP%\20110911\7za.exe' x -otools %TEMP%\20110911\tools.zip AdbWinApi.dll
'%TEMP%\20110911\7za.exe' x -otools %TEMP%\20110911\tools.zip 7za.exe
'%TEMP%\20110911\7za.exe' x -otools %TEMP%\20110911\tools.zip adb.exe
'%TEMP%\20110911\7za.exe' x -otools %TEMP%\20110911\tools.zip aapt.exe
'%TEMP%\20110911\7za.exe' x -otools %TEMP%\20110911\tools.zip AdbWinUsbApi.dll
'%TEMP%\20110911\7za.exe' x -otools %TEMP%\20110911\tools.zip smali.jar' (with hidden window)
'%TEMP%\20110911\7za.exe' x -otools %TEMP%\20110911\tools.zip AdbWinUsbApi.dll' (with hidden window)
'%TEMP%\20110911\7za.exe' x -otools %TEMP%\20110911\tools.zip Frameworks' (with hidden window)
'%TEMP%\20110911\7za.exe' x -otools %TEMP%\20110911\tools.zip zipalign.exe' (with hidden window)
'%TEMP%\20110911\7za.exe' x -otools %TEMP%\20110911\tools.zip testkey.x509.pem' (with hidden window)
'%TEMP%\20110911\7za.exe' x -otools %TEMP%\20110911\tools.zip testkey.pk8' (with hidden window)
'%TEMP%\20110911\7za.exe' x -otools %TEMP%\20110911\tools.zip aapt.exe' (with hidden window)
'%TEMP%\20110911\7za.exe' x -otools %TEMP%\20110911\tools.zip baksmali.jar' (with hidden window)
'%TEMP%\20110911\7za.exe' x -otools %TEMP%\20110911\tools.zip roptipng.exe' (with hidden window)
'%TEMP%\20110911\7za.exe' x -otools %TEMP%\20110911\tools.zip adb.exe' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C java -version' (with hidden window)
'%TEMP%\20110911\7za.exe' x -otools %TEMP%\20110911\tools.zip apktool2.0.0b9.jar' (with hidden window)
'%TEMP%\20110911\7za.exe' x -otools %TEMP%\20110911\tools.zip apktool1.5.2.jar' (with hidden window)
'%TEMP%\20110911\7za.exe' x -otools %TEMP%\20110911\tools.zip AdbWinApi.dll' (with hidden window)
'%TEMP%\20110911\7za.exe' x -otools %TEMP%\20110911\tools.zip signapk.jar' (with hidden window)
'%TEMP%\20110911\7za.exe' x -otools %TEMP%\20110911\tools.zip 7za.exe' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C "<Current directory>\tools\adb.exe" version' (with hidden window)