Virus:Worm/IRCBot.AZ.58
Date discovered:06/09/2005
Type:Worm
In the wild:No
Reported Infections:Low
Distribution Potential:Medium
Damage Potential:Medium
Static file:Yes
File size:110.181 Bytes
MD5 checksum:4c6f497013fa84ddae063c3915c3bf62
VDF version:6.31.0.220

 General Methods of propagation:
   • Local network
   • Mapped network drives


Aliases:
   •  Symantec: W32.Spybot.Worm
   •  Mcafee: W32/Pate.dr
   •  Kaspersky: Backdoor.Win32.IRCBot.az
   •  TrendMicro: BKDR_IRCBOT.AL
   •  F-Secure: W32/Sdbot.LEZ
   •  VirusBuster: Worm.RBot.CAC
   •  Bitdefender: Backdoor.SDBot.358ABA45


Platforms / OS:
   • Windows 95
   • Windows 98
   • Windows 98 SE
   • Windows 2000
   • Windows XP


Side effects:
   • Uses its own Email engine
   • Records keystrokes
   • Registry modification
   • Makes use of software vulnerability
   • Steals information
   • Third party control

 Files It copies itself to the following location:
   • %SYSDIR%\tesakrmger.exe



It deletes the initially executed copy of itself.

 Registry The following registry keys are added in order to run the processes after reboot:

– HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
   • "Windeows NetStart Service2"="tesakrmger.exe"

– HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
   • "Windeows NetStart Service2"="tesakrmger.exe"



The following registry key is added:

– HKCU\Software\Microsoft\OLE
   • "Windeows NetStart Service2"="tesakrmger.exe

 Network Infection In order to ensure its propagation the malware attemps to connect to other machines as described below.

It drops copies of itself to the following network shares:
   • IPC$
   • Admin$\system32
   • c$\winnt\system32
   • c$\windows\system32


It uses the following login information in order to gain access to the remote machine:

–Cached usernames and passwords.

– The following list of usernames:
   • accounting; accounts; admin; administrador; administrat;
      administrateur; administrator; admins; bill; bob; brian; chris;
      computer; database; default; eric; fred; george; guest; home;
      homeuser; ian; internet; intranet; jen; joe; john; kate; katie; lee;
      luke; mary; mike; neil; oem; oeminstall; oemuser; oracle; owner;
      peter; root; sam; staff; student; sue; susan; teacher; user; windows;
      bob; wwwadmin

– The following list of passwords:
   • 7; 123; 1234; 2000; 2001; 2002; 2003; 2004; 12345; 123456; 1234567;
      12345678; 123456789; 1234567890; access; adm; admin; administrador;
      administrat; administrateur; administrator; admins; asd; backup;
      bitch; blank; changeme; cisco; compaq; control; data; database;
      databasepass; databasepassword; db1; db1234; db2; dbpass; dbpassword;
      default; dell; demo; domain; domainpass; domainpassword; exchange;
      fuck; god; guest; hell; hello; ibm; internet; lan; linux; login;
      loginpass; mail; main; nokia; none; null; office; oracle; orainstall;
      outlook; pass; pass1234; passwd; password; password1; pwd; qaz; qwe;
      qwerty; root; server; sex; siemens; slut; sql; sqlpassoainstall;
      system; technical; test; unix; web; win2000; win2k; win98; winnt;
      winpass; winxp; www; zxc



Exploit:
It makes use of the following Exploits:
– MS02-061 (Elevation of Privilege in SQL Server Web)
– MS03-026 (Buffer Overrun in RPC Interface)
– MS03-039 (Buffer Overrun in RPCSS Service)
– MS03-049 (Buffer Overrun in the Workstation Service)
– MS04-011 (LSASS Vulnerability)
– MS05-039 (Vulnerability in Plug and Play)
– Bagle backdoor (port 2745)
– Kuang backdoor (port 17300)
– Mydoom backdoor (port 3127)
– NetDevil backdoor (port 903)
– Optix backdoor (port 3140)
– SubSeven backdoor (port 27347)
– DameWare remote administration (port 6129)


IP address generation:
It creates random IP addresses while it keeps the first two octets from its own address. Afterwards it tries to establish a connection with the created addresses.


Infection process:
Creates a TFTP or FTP script on the compromised machine in order to download the malware to the remote location.


Slow down:
–It creates multiple infection threads.
– Depending on your bandwidth you might notice a fall in your network speed. As the network activity for this malware is medium you might not take notice of this if you have a broadband connection.
– You might also notice a slow down due to the multiple network threads created.

 IRC To deliver system information and to provide remote control it connects to the following IRC Server:

Server: wiched.unstable**********.info
Port: 6667
Channel: #Ownerz
Nickname: USA|%random character string%
Password: netown3rz



– This malware has the ability to collect and send information such as:
    • Cached passwords
    • Capture screen
    • Capture shot from webcam
    • CPU speed
    • Current user
    • Details about drivers
    • Free disk space
    • Free memory
    • Malware uptime
    • Information about the network
    • Information about running processes
    • Size of memory
    • System directory
    • Username
    • Windows directory


– Furthermore it has the ability to perform actions such as:
    • Launch DDoS ICMP flood
    • Launch DDoS SYN flood
    • Launch DDoS TCP flood
    • Launch DDoS UDP flood
    • Disable DCOM
    • Disable network shares
    • Download file
    • Edit registry
    • Enable DCOM
    • Enable network shares
    • Execute file
    • Join IRC channel
    • Kill process
    • Leave IRC channel
    • Open remote shell
    • Perform DDoS attack
    • Perform network scan
    • Perform port redirection
    • Register a service
    • Restart system
    • Send emails
    • Start keylog
    • Start spreading routine
    • Terminate process
    • Updates itself
    • Visit a website

 Backdoor The following ports are opened:

– %SYSDIR%\tesakrmger.exe on TCP port 80 in order to provide an HTTP server.
– %SYSDIR%\tesakrmger.exe on a random TCP port in order to provide an FTP server.
– %SYSDIR%\tesakrmger.exe on UDP port 69 in order to provide a TFTP server.

 Stealing It tries to steal the following information:
– Windows Product ID

– The following CD keys:
   • Soldier of Fortune II - Double Helix; Battlefield 1942; Battlefield
      1942 (Road To Rome); Battlefield 1942 (Secret Weapons of WWII);
      Battlefield Vietnam; Black and White; Chrome; Command and Conquer:
      Generals; Command and Conquer: Generals (Zero Hour); Command and
      Conquer: Red Alert; Command and Conquer: Red Alert 2; Command and
      Conquer: Tiberian Sun; Counter-Strike (Retail)"; FIFA 2002; FIFA 2003;
      Freedom Force; Global Operations; Gunman Chronicles; Half-Life; Hidden
      & Dangerous 2; IGI 2: Covert Strike; Industry Giant 2; James Bond 007:
      Nightfire; Legends of Might and Magic; Medal of Honor: Allied Assault;
      Medal of Honor: Allied Assault: Breakthrough; Medal of Honor: Allied
      Assault: Spearhead; mtkwftmkemfew3p3b7; Nascar Racing 2002; Nascar
      Racing 2003; Need For Speed Hot Pursuit 2; Need For Speed:
      Underground; Neverwinter Nights; Neverwinter Nights (Hordes of the
      Underdark); Neverwinter Nights (Shadows of Undrentide); NHL 2002; NHL
      2003; NOX; Rainbow Six III RavenShield; Shogun: Total War: Warlord
      Edition; Soldiers Of Anarchy; The Gladiators; Unreal Tournament 2003;
      Unreal Tournament 2004

– It uses a network sniffer that checks for the following strings:
   • :.login; :,login; :!login; :@login; :$login; :%login; :^login;
      :&login; :*login; :-login; :+login; :/login; :\login; :=login;
      :?login; :'login; :`login; :~login; : login; :.auth; :,auth; :!auth;
      :@auth; :$auth; :%auth; :^auth; :&auth; :*auth; :-auth; :+auth;
      :/auth; :\auth; :=auth; :?auth; :'auth; :`auth; :~auth; : auth; :.id;
      :,id; :!id; :@id; :$id; :%id; :^id; :&id; :*id; :-id; :+id; :/id;
      :\id; :=id; :?id; :'id; :`id; :~id; : id; :.hashin; :!hashin;
      :$hashin; :%hashin; :.secure; :!secure; :.l; :!l; :$l; :%l; :.x; :!x;
      :$x; :%x; :.syn; :!syn; :$syn; :%syn

– A logging routine is started after keystrokes are typed that match one of the following strings:
   • USER
   • PASS
   • paypal
   • PAYPAL
   • paypal.com
   • PAYPAL.COM

 Miscellaneous Mutex:
It creates the following Mutex:
   • mansorbetaf1le


String:
Furthermore it contains the following string:
   • netmaniac was here

 File details Programming language:
 The malware program was written in MS Visual C++.


Runtime packer:
In order to aggravate detection and reduce size of the file it is packed with the following runtime packers:
   • PE_Patch;
   • MewBundle;
   • MEW;
   • NSPack;

Description inserted by Irina Boldea on Tuesday, September 6, 2005
Description updated by Irina Boldea on Monday, September 19, 2005

Back . . . .