TR/Proxy.Bobax.b - Trojan

Siehe auch

Vollständig

Alias:	W32.Bobax.B, TrojanProxy.Win32.Bobax.b, W32/Bobax.worm.b
Type:	Trojan
Size:	21, 504 Bytes
Origin:	unknown
Date:	05-17-2004
Damage:	Uses LSASS security hole, spreads by email.
VDF Version:	6.25.00.75 - Mon, 24 May 2004 15:06 (GMT+1)
Danger:	Medium
Distribution:	Medium

DistributionThe Trojan scans random IP addresses and tries to connect to TCP Port 5000 to find more Windows XP systems. When connection is made, the following will happen:
- sends Shell codes over TCP Port 445;
- downloads the executable copy of the worm, with a .gif extension and runs it;
- tries to use the Microsoft Windows LSASS security hole buffer overrun.

It opens a random port and waits for further connections. The worm runs its SMTP server routine and sends spam from the infected computer.

Technical DetailsWhen activated, the Trojan Proxy.Bobax.b makes a Mutex "04:12:20:%random number%". So it verifies if there is active any other of its own tasks on the system. It copies itself in %SystemDIR%\%file name%.exe and tries to make these two registry entries:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\
CurrentVersion\Run\
"%Variable%"="%SystemDIR%\%File name%.exe"

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\
CurrentVersion\RunServices
"%Variable%"="%SystemDIR%\%File name%.exe"

These entries will automatically start the worm by every system start. The worm deletes all files in %Temp% with names starting with "~". It drops a %random name%.DLL in %Temp%. This file contains the main function of the worm. This DLL will be started only with EXPLORER.EXE process, so that it will not be seen in the task list.

The worm tries to download the following files from certain web sites, to test the speed of the internet connection:
- SETUPDL.EXE
- Install_Aim.exe
- WindowsXP-KB835732-x86-ENU.EXE
- ymsgr_2.5.3-ppc_install.bin

Then it tries to connect to a web server. It uses an unique ID code, to spread the infection. It can do the following:
- send spam mails;
- send system information to the author;
- stops and starts scanning for IP addresses;
- download and start files;
- self-update.

Kurzfassung hier.

Beschreibung erstellt von Crony Walker am Tue, 15 Jun 2004 14:00 (GMT+1)

» Über Malware
» Über Phishing
» In-the-Wild-Viren

« zurück