Nume:Worm/Pushbot.7577
Descoperit pe data de:24/09/2009
Tip:Vierme
ITW:Da
Numar infectii raportate:Scazut spre mediu
Potential de raspandire:Scazut spre mediu
Potential de distrugere:Mediu
Fisier static:Da
Marime:75.776 Bytes
MD5:eea6cee9d7cb77adfc9ff7a544220d9c
Versiune IVDF:7.01.06.31 - Donnerstag, 24. September 2009

 General Metoda de raspandire:
• Functia autorun


Sistem de operare:
   • Windows 2000
   • Windows XP
   • Windows 2003


Efecte secundare:
   • Descarca fisiere malware
   • Creeaza fisiere malware
   • Reduce setarile de securitate
   • Modificari in registri

 Fisiere Se copiaza in urmatoarele locatii:
   • %WINDIR%\iexplorer7.exe
   • %unitate disc%\RECYCLER\%CLSID%\sysmngr32.exe



Sunt create fisierele:

– %WINDIR%\log32.txt
– %unitate disc%\autorun.inf Acesta este un fisier text care nu prezinta pericol si are urmatorul continut:
   • %cod care ruleaza fisierul malitios%

– %unitate disc%\RECYCLER\%CLSID%\Desktop.ini



Incearca sa descarce un fisier:

– Adresele sunt urmatoarele:
   • http://www.pr0.net/deny2/**********
   • http://www.sevy.eu.org/**********
   • http://www.proxysecurity.com/**********
   • http://www.proxy-heaven.com/**********
   • http://www.pr0.net/deny2/**********
   • http://www.cooleasy.com/**********
   • http://www.belgarion.com/images/**********
   • http://proxywoorld.ovh.org/**********
   • http://proxyworld.ifrance.com/**********
La momentul realizarii descrierii, acest fisier nu era disponibil pentru o analiza ulterioara.

 Registrii sistemului Una din urmatoarele valori este adaugata in registri pentru pornirea automata a procesului dupa reboot:

–  [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
   • "Microsoft Driver Setup"="%WINDIR%\iexplorer7.exe"



Se adauga in registrii sistemului:

– [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\
   Run]
   • "Microsoft Driver Setup"="%WINDIR%\iexplorer7.exe"



Urmatoarea cheie din registri este modificata:

– [HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\
   FirewallPolicy\StandardProfile]
   Noua valoare:
   • "EnableFirewall"=dword:0x00000000

 Messenger Se raspandeste prin messenger. Caracteristicile sunt:

– MSN Messenger


Catre:
Toate intrarile din lista de contacte.

 Reţea Exploit:
Foloseste urmatoarele vulnerabilitati:
– MS03-007 (Unchecked Buffer in Windows Component)
– MS03-039 (Buffer Overrun in RPCSS Service)
–MS06-040 (Vulnerability in Server Service)

 IRC Pentru a trimite informatii si pentru a fi controlat se conecteaza la serverele IRC:

Server: login.i**********.org.uk
Port: 47221
Canal: #e10
Nick: [N00_USA_XP_%numar%]%combinatie de caractere aleatoare%

Server: login.i**********.co.uk
Port: 47221
Canal: #e10
Nick: [N00_USA_XP_%numar%]%combinatie de caractere aleatoare%

Server: login.in**********.com
Port: 47221
Canal: #e10
Nick: [N00_USA_XP_%numar%]%combinatie de caractere aleatoare%

Server: myip.wo**********.net
Port: 47221
Canal: #e10
Nick: [N00_USA_XP_%numar%]%combinatie de caractere aleatoare%

Server: ip.w**********.com
Port: 47221
Canal: #e10
Nick: [N00_USA_XP_%numar%]%combinatie de caractere aleatoare%


– In plus, poate efectua urmatoarele operatii:
    • descarcare fisier
    • executarea unui fisier
    • Scaneaza reteaua
    • Se actualizeaza singur

 Terminarea proceselor Lista cu procesele oprite:
   • VIPRE.EXE; ISSDM_EN_32.EXE; P08PROMO.EXE; K7TS_SETUP.EXE;
      AVINSTALL.EXE; WITSETUP.EXE; TrendMicro_TISPro_16.1_1063_x32.EXE;
      VBA32-PERSONAL-LATEST-ENGLISH.EXE; CCSETUP210.EXE; FSMB32.EXE;
      FSGK32.EXE; FSAV95.EXE; FSAV530WTBYB.EXE; FSAV530STBYB.EXE;
      FSAV32.EXE; FSAV.EXE; FSAA.EXE; FPROT.EXE; FP-WIN.EXE; FNRB32.EXE;
      FIH32.EXE; FCH32.EXE; FAST.EXE; FAMEH32.EXE; F-STOPW.EXE;
      F-PROT95.EXE; F-PROT.EXE; AFMAIN.EXE; SPIDERUI.EXE; SPIDERNT.EXE;
      ALERTMAN.EXE; RAVMOND.EXE; MAKEREPORT.EXE; BOXMOD.EXE; 360SAFE.EXE;
      360RPT.EXE; 360HOTFIX.EXE; 360TRAY.EXE; NSVMON.NPC; NSAVSVC.NPC;
      NPCGREENAGENT.NPC; PUSCAN.EXE; AYSERVICENT.AYE; AYAGENT.AYE;
      CMDAGENT.EXE; CPF.EXE; VSMON.EXE; ZLCLIENT.EXE; NSUTILITY.EXE;
      NSPUPDT.EXE; NAVQSCAN.EXE; NSPMAIN.EXE; NSPUPSVC.EXE; NSPSVC.EXE;
      MKSADMINCONSOLE.EXE; MKSUPDATE.EXE; MKSPC.EXE; MKSFWALL.EXE;
      MKSVIRMONSVC.EXE; MKS_SCAN.EXE; MKS_MAIL.EXE; MKSREGMON.EXE;
      KAVPFW.EXE; KASMAIN.EXE; KAV32.EXE; KPFWSVC.EXE; KISSVC.EXE;
      KWATCH.EXE; KPFW32.EXE; KAVSTART.EXE; KVSRVXP.EXE; KVOL.EXE; KVXP.KXP;
      KVMONXP.KXP; CAVASM.EXE; CMAIN.EXE; ARCABIT.CORE.LOGGINGSERVICE.EXE;
      ARCABIT.CORE.CONFIGURATOR2.EXE; TASKSCHEDULER.EXE; UPDATE.EXE;
      NETMONSV.EXE; FILEMONSV.EXE; ABREGMON.EXE.EXE; ARCACHECK.EXE;
      ARCAVIR.EXE; AVMENU.EXE; A2HIJACKFREE.EXE; A2SERVICE.EXE; A2START.EXE;
      A2SCAN.EXE; A2GUARD.EXE; VRFWSVC.EXE; HFACSVC.EXE; VRMONSVC.EXE;
      HPCSVC.EXE; HSVCMOD.EXE; VRMONNT.EXE; MKSTRAY.EXE; VBA32ADS.EXE;
      VBA32LDR.EXE; FILELOCKSETUP.EXE; TSCFCOMMANDER.EXE; TMPROXY.EXE;
      TMPFW.EXE; TMBMSRV.EXE; UFNAVI.EXE; UFSEAGNT.EXE; TISSPWIZ.EXE;
      SFCTLCOM.EXE; TNBUTIL.EXE; DEFWATCH.EXE; RTVSCAN.EXE; SBAMSVC.EXE;
      SBAMUI.EXE; SBAMTRAY.EXE; SAVADMINSERVICE.EXE; SAVSERVICE.EXE;
      SCFSERVICE.EXE; SCFMANAGER.EXE; RAVTASK.EXE; CCENTER.EXE; ULIBCFG.EXE;
      RAVLITE.EXE; PCTAV.EXE; PCTAVSVC.EXE; PXCONSOLE.EXE; PXAGENT.EXE;
      RAV.EXE; PCTSAUXS.EXE; PCTSTRAY.EXE; PCTSSVC.EXE; PCTSGUI.EXE;
      AVGAS.EXE; PAVBCKPT.EXE; WEBPROXY.EXE; PAVSRV51.EXESRVLOAD.EXE;
      PSIMSVC.EXE; PSHOST.EXE; AVENGINE.EXE; PSKMSSVC.EXE; PAVPRSRV.EXE;
      PAVFNSVR.EXE; PSCTRLS.EXE; TPSRV.EXE; NOD32M2.EXE; NOD32CC.EXE;
      NOD32.EXE; NMAIN.EXE; NOD32KUI.EXE; MSASCUI.EXE; MSMPENG.EXE;
      MCUPDATE.EXE; MCSHIELD.EXE; MCVSSHLD.EXE; MCVSRTE.EXE; MCAGENT.EXE;
      KAVSVC.EXE; KAV.EXE; K7TSMNGR.EXE; K7SPMSRC.EXE; K7RTSCAN.EXE;
      K7PSSRVC.EXE; K7FWSRVC.EXE; K7EMLPXY.EXE; K7TSECURITY.EXE;
      K7SYSTRY.EXE; VIRUSUTILITIES.EXE; GUARDXSERVICE.EXE;
      GUARDXKICKOFF.EXE; AVKWCTL.EXE; AVKTUNERSERVICE.EXE; AVKSERVICE.EXE;
      GDFWSVC.EXE; AVKPROXY.EXE; GDFIRE~1.EXE; AVKTRAY.EXE;
      GDFIREWALLTRAY.EXE; FSAUA.EXE; NOD32KRN.EXE; FSMA32.EXE; FSDFWD.EXE;
      FSGK32ST.EXE; FSM32.EXE; FPWIN.EXE; FPAVSERVER.EXE; FPROTTRAY.EXE;
      INICIO.EXE; UMXPOL.EXE; UMXFWHLP.EXE; UMXAGENT.EXE; UMXCFG.EXE;
      PPCLTPRIV.EXE; SVCPRS32.EXE; ITMRTSVC.EXE; CCPROVSP.EXE; MDMCLS32.EXE;
      CAGLOBALLIGHT.EXE; CAPFUPGRADE.EXE; CAPFASEM.EXE; CAFW.EXE;
      CFGMNG32.EXE; CCTRAY.EXE; CLAMTRAY.EXE; CLAMWIN.EXE; ALSVC.EXE;
      ALMON.EXE; DRWEBSCD.EXE; SPIDERML.EXE; DRWEB32W.EXE; ACS.EXE;
      STRTSVC.EXE; OP_MON.EXE; SENSOR.EXE; QHFW332.EXE; CATEYE.EXE;
      ONLNSVC.EXE; EMLPROUI.EXE; UPSCHD.EXE; SCANMSG.EXE; SCANWSCS.EXE;
      EMLPROXY.EXE; ONLINENT.EXE; ASWCLNR.EXE; BDAGENT.EXE; VSSERV.EXE;
      LIVESRV.EXE; XCOMMSVR.EXE; UISCAN.EXE; BDSS.EXE; AVGUI.EXE;
      AVGUPD.EXE; AVGSCANX.EXE; AVGEMC.EXE; AVGUPSVC.EXE; AVGAMSVR.EXE;
      AVGWDSVC.EXE; ASHWEBSV.EXE; ASHMAISV.EXE; ASWUPDSV.EXE; ASHSERV.EXE;
      ASHDISP.EXE; AVCENTER.EXE; SCHED.EXE; AVIRARKD.EXE; AVGNT.EXE;
      AVGUARD.EXE; AHNSDSV.EXE; ACAIS.EXE; ACALS.EXE; ACAEGMGR.EXE;
      ACAAS.EXE; QOELOADER.EXE; APVXDWIN.EXE; QUHLPSVC.EXE; 123.EXE;
      RAVP.EXEMBAM.EXE123.COM; UNLOCKER1.8.7.EXE; UNIEXTRACT.EXE;
      SYSANALYZER_SETUP.EXE; STARTDRECK.EXE; SPF.EXE; REGX2.EXE;
      REGSHOT.EXE; REGSCANNER.EXE; REGISTRAR_LITE.EXE; REGCOOL.EXE;
      REGALYZ.EXE; PROJECTWHOISINSTALLER.EXE; PROCMON.EXE; CUREIT.EXE;
      FIXBAGLE.EXE; PGSETUP.EXE; OBJMONSETUP.EXE; NETALYZ.EXE; KILLBOX.EXE;
      INSTALLWATCHPRO25.EXE; AVENGER.EXE; IEFIX.EXE; HOSTSFILEREADER.EXE;
      FIXPATH.EXE; FILEFIND.EXE; FILEALYZ.EXE; EULALYZERSETUP.EXE;
      A2HIJACKFREESETUP.EXE; DLLCOMPARE.EXE; CPROCESS.EXE; CPORTS.EXE;
      ASVIEWER.EXE; APT.EXE; APM.EXE; WIRESHARK.EXE; SPYBOTSD.EXE;
      TEATIMER.EXE; SPYBOTSD160.EXE; PROCESSMONITOR.EXE; PROCDUMP.EXE;
      PG2.EXE; LORDPE.EXE; ICESWORD.EXE; REANIMATOR.EXE; ROOTKITNO.EXE;
      RKD.EXE; HACKMON.EXE; UNHACKME.EXE; ROOTKIT_DETECTIVE.EXE;
      AVGARKT.EXE; FSB.EXE; FSBL.EXE; ROOTKITREVEALER.EXE; PSKILL.EXE;
      TASKMON.EXE; TASKLIST.EXE; TASKMAN.EXE; PROCEXP.EXE; MSNFIX.EXE;
      HIJACKTHIS_V2.EXE; HIJACKTHIS.EXE; HIJACKTHIS_SFX.EXE; HJTSETUP.EXE;
      HJTINSTALL.EXE; OLLYDBG.EXE; NETSTAT.EXE; PORTMONITOR.EXE;
      PORTDETECTIVE.EXE; FPORT.EXE; APORTS.EXE; PAVARK.EXE; DARKSPY105.EXE;
      HELIOS.EXE; ROOTKITBUSTER.EXE; ROOTALYZER.EXE; BC5CA6A.EXE; SEEM.EXE;
      DELAYDELFILE.EXE; DUBATOOL_AV_KILLER.EXE; SUPERKILLER.EXE;
      KAKASETUPV6.EXE; BUSCAREG.EXE; MSNCLEANER.EXE; SRESTORE.EXE;
      BOOTSAFE.EXE; SUPERANTISPYWARE.EXE; CCLEANER.EXE;
      REGUNLOCKER.EXETSNTEVAL.EXEXP_TASKMGRENAB.EXE; CF9409.EXE; GMER.EXE;
      CATCHME.EXE; SDFIX.EXE; COMBOFIX.EXE; SRENGPS.EXE; AUTORUNS.EXE;
      TASKKILL.EXE; REGEDIT.EXE; REG.EXE; MYPHOTOKILLER.EXE;
      KILLAUTOPLUS.EXE; FOLDERCURE.EXE; REGEDIT.SCR; REGEDIT.COM; MMC.EXE;
      TCPVIEW.EXE; LISTO.EXE; GUARD.EXE; NTVDM.EXE; COMMAND.COM;
      COMBOFIX.COM; COMBOFIX.SCR; COMBOFIX.BAT; REGMON.EXE;
      OTMOVEIT.EXEMBAM-SETUP.EXE; JAJA.EXE; AVZ.EXE; MBAM.EXE;
      MBAM-SETUP.EXE; PENCLEAN.EXE; ELISTA.EXE; HJ.EXE;
      WINDOWS-KB890930-V2.2.EXE; MRTSTUB.EXE; MRT.EXE; HIJACK-THIS.EXE;
      VIRUS.EXE; SAFEBOOTKEYREPAIR.EXEOTMOVEIT3.EXEHOSTSXPERT.EXEDAFT.EXE;
      ATF-CLEANER.EXE; COMPAQ_PROPIETARIO.EXE; SRENGLDR.EXE; HOOKANLZ.EXE


 Detaliile fisierului Compresia fisierului:
Pentru a ingreuna detectia si a reduce marimea fisierului, este folosit un program de compresie runtime.

Die Beschreibung wurde erstellt von Petre Galan am Donnerstag, 4. Februar 2010
Die Beschreibung wurde geändert von Petre Galan am Freitag, 5. Februar 2010

zurück . . . .