The backdoor's file is a PE executable. It is very rare if the variant is smaller than 299kB. The kit used to make this family of malware has default settings to pack the code as UPX. Unpacked the code size is 710kB. Hupigons are written with Borland Delphi.

When the backdoor's file is started, it copies itself as a file named something similar to "Hacker.com.cn.exe" in the Windows System folder and then creates the following startup key value in the Registry:

• HKLMSystemCurrentControlSetServicessystem32
  ImagePath = C:WINDOWSHacker.com.cn.exe

And it creates these keys:

• HKLMSystemCurrentControlSetServicessystem32
• HKLMSystemCurrentControlSetServicessystem32Security

Overall, Hupigon variants have several different types of features. The following list is an example of some:

• It allows others to access the computer
• Allows for recording with the user's webcam
• Can make the user's computer to attack various servers
• Send victim's computer messages
• Has rootkit functionality so it has a stealth component that hides files
• Create logs from keystrokes, steals passwords, and sends this information to remote servers.
  

Typically, Hupigon clones itself to some installation path such as system32 and uses the following processes to make itself to look like a valid Windows program:

• calc.exe
• cmd.exe
• mmc.exe
• mspaint.exe
• mstsc.exe
• notepad.exe
• osk.exe
• sndrec.exe
• sndvol32.exe
• svchost.exe
• winchat.exe

The kit that creates Hupigon variants has default settings to create mutexes. So many Hupigons have created mutexes which are in the following format:

• xxx.com.cn_MUTEX

The "xxx" being a variable. Example: Hacker.com.cn_MUTEX

The following strings can typically be found in a Hupigon variant:

• 6600.org
• BEI_ZHU
• GrayPigeon
• Hacker.com.cn.exe
• huaihuaitudou
• Rejoice2007
• woainisisi

Hupigon doesn't have any automatic mechanisms to spread itself, so it must be sent by its author via e-mail, through a website, or even via Instant Messengers (IM) such as Yahoo, MSN, ICQ, and Skype.

Last update 07 November 2007

 

TOP