Backdoor:W32/Simda is a large family of malware that, once installed on a machine, can be remotely controlled by an attacker to perform various actions, most commonly stealing personal or system data, taking screenshots and downloading additional files onto the system. Infected machines are collected into a botnet.
Based on the settings of your F-Secure security product, it will either move the file to the quarantine where it cannot spread or cause harm, or remove it.
Some Simda variants will drop a copy of its malicious file as a randomly-named file (e.g., o7oceiq.exe or s93sk.exe) to the root of the %APPDATA% folder. In some cases, users may need to manually delete this file and reboot their system in order to remove all traces of the malware from their machine.
A False Positive is when a file is incorrectly detected as harmful, usually because its code or behavior resembles known harmful programs. A False Positive will usually be fixed in a subsequent database update without any action needed on your part. If you wish, you may also:
Check for the latest database updates
First check if your F-Secure security program is using the latest updates, then try scanning the file again.
Submit a sample
After checking, if you still believe the file is incorrectly detected, you can submit a sample of it for re-analysis.
Note: If the file was moved to quarantine, you need to collect the file from quarantine before you can submit it.
Exclude a file from further scanning
If you are certain that the file is safe and want to continue using it, you can exclude it from further scanning by the F-Secure security product.
Note: You need administrative rights to change the settings.
Backdoor:W32/Simda was first seen in 2009, and has since rapidly expanded into a large family of malware with a wide range of capabilities. Early variants focused primarily on stealing passwords and other data from infected machines. In 2013, Simda was reportedly found being used as a banking trojan (primarily targeting banks in Russia and Europe).
Since then, Simda has been used by cybercriminals to rope infected machines into a botnet, with the operators behind it selling access to the affected computers. In April 2015, the Simda botnet was targeted in a coordinated international takedown operation.
Simda variants are typically distributed via compromised sites that redirect users to websites hosting exploit kits, which deliver the malware onto systems containing vulnerabilities the kits are able to exploit.
When executed on a machine, Backdoor:W32/Simda will install a copy of itself, then delete the original file.
During installation, some Simda variants include routines to check for the presence of virtual machines, sandboxes, debugging programs or network traffic analysis tools (essentially, programs that are often used by security researchers); if found, the malware will delete itself. This check allows the malware to evade systems that could potentially spot the infection in progress.
Some variants search for and stop processes related to anti-malware or security programs, in order to protect its own processes from identification. Some also monitor the web sites being visited on the machine and block access to sites related to security vendors.
If successfully installed, Simda will hook into various APIs in order to capture various types of data, depending on the specific variant involved. Data captured may include network and machine information, online banking and shopping details, email credentials, browser history details, screenshots and so on.
Some Simda variants will open a port on the infected machine to give a remote attacker direct control. Most variants will also contact a remote command and control (C&C) server to retrieve instructions from the attacker. Data collected from the machine may also be forwarded to the C&C server.
If the affected account is not already logged in as administrator, some Simda variants will attempt to log in as an administrator, using a list of common passwords.
Other variants will try to exploit vulnerabilities present (CVE-2010-0232, MS10-092, MS10-015) in order to gain more privileges on the machine, which would allow it to perform a greater range of actions.
On 13 April 2015, a coordinated takedown involving the Dutch National High Tech Crime Unit (NHTCU), the American Federal Bureau of Investigations (FBI), the Russian Ministry of the Interior’s Cybercrime Department "K", INTERPOL National Central Bureau and certain antivirus firms conducted a series of raids that physically seized 10 servers used to control the Simda botnet.
The removal of the C&C servers removed the ability of the operators to issue commands to machines in the botnet; the individual machines however remain infected. Users of these machines are therefore urged to run a trusted antivirus program to disinfect their systems of the infection in order to be protected from future misuse.
For more information, see: