Nume:Worm/SdBot.bdw
Descoperit pe data de:19/06/2007
Tip:Vierme
ITW:Da
Numar infectii raportate:Scazut
Potential de raspandire:Mediu
Potential de distrugere:Mediu
Fisier static:Da
Marime:60.928 Bytes
MD5:61bd1eca45b4e44fdfc657bbf01bd387
Versiune VDF:6.39.00.34 - Tuesday, June 19, 2007
Versiune IVDF:6.39.00.34 - Tuesday, June 19, 2007

 General Metoda de raspandire:
   • Reteaua locala


Alias:
   •  Symantec: W32.Randex
   •  Mcafee: W32/Sdbot.worm
   •  Kaspersky: Backdoor.Win32.SdBot.bdw
   •  TrendMicro: Win32/Sdbot!8F5A


Sistem de operare:
   • Windows 95
   • Windows 98
   • Windows 98 SE
   • Windows NT
   • Windows ME
   • Windows 2000
   • Windows XP
   • Windows 2003


Efecte secundare:
   • Blocheaza accesul la website-uri ale firmelor de securitate
   • Creeaza un fisier malware
   • Reduce setarile de securitate
   • Inregistreaza intrarile de la tastatura
   • Modificari in registri
   • Sustrage informatii
   • Posibilitatea accesului neautorizat la computer

 Fisiere Se copiaza in urmatoarea locatie:
   • %SYSDIR%\csos.exe

– c:\sirh0t_changes_ur_hostfile.bat Analiza ulterioara a relevat ca si acest fisier este malware. Detectat ca: BAT/Qhost.A

 Registrii sistemului Urmatoarele chei sunt adaugate in registri pentru a rula procesul la repornirea sistemului:

– [HKLM\Software\Microsoft\Windows\CurrentVersion\Run]
   • csos="csos.exe"

– [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
   • csos="csos.exe"



Urmatoarele chei sunt adaugate in registri pentru a incarca serviciul la repornirea sistemului:

– [HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices]
   • csos="csos.exe"



Creeaza urmatoarea valoare, pentru a trece de Windows XP firewall:

– [HKLM\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\
   FirewallPolicy\StandardProfile\AuthorizedApplications\List]
   • %WINDIR%\system32\csos.exe="%WINDIR%\system32\csos.exe:*:Enabled:@xpsp2res.dll,-22019"

 Reţea Pentru a-si asigura raspandirea, programul malware incearca sa contacteze alte sisteme, asa cum este descris in continuare:

Creeaza copii malware in urmatoarele share-uri de retea:
   • profiles$
   • IPC$
   • D$
   • print$
   • E$
   • Admin$
   • Admin$\system32
   • ipc$


Foloseste urmatoarele date de logare, pentru a controla sistemul la distanta:

– Lista de utilizatori si parole:
   • zxcv; zxc; zulu; zombie; zmodem; zimmerman; zimmerma; ziggy; zeitgeis;
      zebra; zap; yxcv; youwontguessme; young; yosemite; yolanda;
      yellowstone; yellowst; yellow; yankee; yang; yaco; xyzzy; xyz;
      xxxxxxxxx; xxxxxxxx; xxxxxxx; xxxxxx; xxxxx; xxxx; xxx; xx; xray; xp;
      xmodem; xmen; xman; xfer; xena; wyoming; wwwadmin; www; wwii; WRITE;
      wormwood; worm; work; worf; wordperf; word; woodwind; wood; women;
      wombat; woman; wolverin; wolf; wizard; within; wiseass; wisconsin;
      wisconsi; wired; winxp; winston; winpass; winnt; wing; wine;
      windozexp; windozeME; windoze98; windoze95; windoze2k; windoze;
      windowz; WindowsXP; windowsME; windows98; windows95; windows2k;
      windows; windose; win98; win2k; win2000; win; wilma; willie;
      williamsburg; williams; william; will; wileecoyote; whore; wholesale;
      wholesal; whitney; whiting; white; whisky; whatnot; whatever; wh0re;
      wh0r3; western; west; werewolf; wendy; wendi; well; weenie; weed;
      wednesda; webpage; web; wave; water; watchwor; wasp; warren; warp;
      wargames; warfare; warez; ward; waco; w00t; vodka; visualba; visual;
      visitor; virus; virginia; virgin; village; videogam; video; victor;
      vicky; vertigo; veronica; venus; vasant; vampire; valerie; vagina;
      uwontguessme; uucp; utility; util; usmc; userpassword; username;
      usermane; user1; User; USER; user; usenet; ursula; urchin; uranus;
      upload; unlock; Unknown; unknown; unix; universi; universe; universa;
      uniform; unicorn; unhappy; undo; uncle; umesh; ugly; tuttle; turnip;
      turn; tuesday; tubas; tty; truth; true; tron; trombone; trojan;
      trivial; trisha; trek; tree; trapdoor; trap; transfer; trails; tracy;
      tracie; traci; toyota; toxic; tortoise; topography; topograp; tomato;
      tokenrin; token; toggle; toad; tits; tina; time; tiger; tiffany;
      thursday; thin; theresa; thailand; text; tetris; testing; testin;
      tester; test123; Test; test; TEST; tess; terminat; terminal; tera;
      tennis; temptation; temptati; temp123; temp; TEMP; telnet; telephone;
      telephon; teenage; teen; technical; tech; tears; teapot; team;
      teacher; taylor; tarragon; target; tara; tape; tango; tangerine;
      tangerin; tammy; tamie; tami; tamara; tall; talk; tabasco; SYSTEM;
      system; sysop; sysadmin; sys; symmetry; sybil; sybase; sword; switch;
      sweat; swearer; suzie; suzanne; susie; susanne; susan; surfing;
      surfer; supported; supporte; support; supervis; superuser; superuse;
      superstage; supersta; superson; superman; super; sunday; sun; summer;
      sue; sucks; suckmydi; suck; success; subway; subscrib; stuttgart;
      stuttgar; student1; student; strip; string; streetfi; stratford;
      stratfor; strangle; strange; stones; stoned; stoneage; steve; stereo;
      stephanie; stephani; steph; steel; steal; steak; starwars; startup;
      startrek; start; starship; star; Standard; staff; stacy; stacie;
      staci; stacey; sr71; squires; sqlpass; sqlagent; sql; spunk; springer;
      spring; spred; spit; spiderma; spider; spice; spencer; spell; spear;
      sparrows; spaceshi; spaceman; south; source; sossina; sonya; sonic;
      sonia; sondra; somebody; software; soft; sodomy; socrates; social;
      soap; snoopy; snatch; snake; snafu; snach; smut; smtp; smother;
      smooch; smiles; smile; smart; small; slut; slow; sliders; slick;
      slave; skull; site; single; singer; simulati; simpsons; simple; simon;
      simcity; silver; signature; signatur; sierra; siemens; sick; shuttle;
      short; shivers; shiva; shitpot; shit; shirley; shift; sherri; shell;
      sheldon; sheffield; sheffiel; sharon; sharks; shark; SHARE; sharc;
      shannon; sexy; sex; sesame; service; SERVER; serial; serenity; sentry;
      sentinel; sensor; sega; seed; security; secret; search; scriptkiddie;
      script; scout; scotty; scott; scorpion; scifi; schoolsucks; school;
      scheme; scamper; saxon; saturn; saturday; satanik; satanic; satan;
      sarah; sara; sandy; sandra; sample; samantha; sam; salt; sale; salami;
      sal; sage; safe; sa; ruth; rush; running; rules; rude; ruby; ruben;
      rubber; RPC; rough; Ross; roses; rosemary; rosebud; rose;
      RoscoPColtrane; RoscoP; Rosco; rooted; ROOT; root; ronald; ron;
      romulan; romeo; romano; rolex; rodent; rockyhor; rocky; rock;
      rochester; rocheste; rochelle; robyn; robotics; robot; robin; robert;
      roach; rje; risc; ripple; riot; ring; rightwin; right; riffraff; rick;
      rich; rhino; reveal; resistan; republic; report; rent; reno; renee;
      remote; release; regional; referenc; redhead; reddawn; record; rebel;
      rebecca; rebal; reaper; ream; really; reality; reagan; READ; razor;
      rascal; rape; random; raleigh; raindrop; rainbow; rain; raid; RAGE;
      rachmaninoff; rachmani; rachelle; rachel; rabbit; r00t; qwerty; qwert;
      qwer; qwe; quebec; qaz; pwd; pw123; pw; pussy; puppet; punk; punisher;
      puneet; pumpkin; puke; puck; public; pub; psychopa; psycho; protozoa;
      protect; prompt; program; profile; professor; professo; processo;
      proceed; privs; private; priv; printer; princeton; princeto; prince;
      presto; prelude; precious; praise; power; poster; post; porsche;
      porno; porn; pork; poor; poop; pondering; ponderin; polynomial;
      polynomi; polly; police; poetry; plymouth; pluto; plover; playboy;
      plane; pizza; piss; pinname; pink; pimp; pierre; pick; phuck; phreak;
      phrase; phrack; photon; phone; phoenix; philip; phil; peter; pete;
      pervert; persona; persimmon; persimmo; permit; perfect; percolate;
      percolat; pepsi; pepper; peoria; pentium; penthous; pentagra;
      pentagon; penname; penis; Penis; penguin; penelope; pencil; pecker;
      peanuts; pc; paula; patty; patriot; patrick; patricia; pat; paste;
      password123; password1; Password; PASSWORD; password; passwd;
      passphra; pass1234; pass123; pass; pascal; papers; paper; papa;
      pamela; pam; pakistan; paint; painless; pad; packer; packard; pacific;
      oxford; Owner; OWNER; owner; owned; own; owa; outside; output;
      outlook; outlaw; outdoors; osiris; oscar; orwell; orient; orca;
      orange; oracle; operator; opensesa; openlock; opening; omega; olivia;
      olivetti; oldage; okay; office; oemuser; oeminstall; OEM; oem; ocelot;
      oceanography; oceanogr; obscurit; nyquist; nuts; nutrition; nutritio;
      number; null; nukem; nuke; nude; nuclear; noxious; november; novel;
      nova; noth; notes; noreen; noob; none; nokia; node; nobody; noble;
      nnaacp; nita; nintendo; Nilez; nightmar; night; nicotine; nicole;
      nice; next; newyork; newton; newsgrou; news; newborn; new; network;
      netscape; netfuck; netdevil; netbios; net-devil; net; ness; neptune;
      nepenthe; neil; ND; navy; nasa; napoleon; nancy; name; nagel; mypc123;
      mypc; mypass123; mypass; mutant; muppets; msdos; MS; mpeg; MP; mozart;
      movies; movie; move; mouse; mountain; mosaic; mortgage; mortalco;
      mortal; morris; morley; more; moose; moor; moom; monica; monday;
      moguls; mogul; modem; mkii; mit; mission; misfit; minsky; minimum;
      mine; mike; midieval; microsof; micropro; microchi; micro; mickey;
      michelle; michele; michelan; michel; michael; mice; mgr; mets;
      metalica; metalhea; metal; merlin; mercury; menu; menace; memory;
      member; melrose; mellon; melissa; megan; megadeth; megabyte; meagan;
      maurice; Matthew; Matt; math; Mat; master; mass; mason; mary; marvin;
      marty; mars; marriage; marni; markus; mark; marines; marijuan;
      marietta; mariens; maria; marcy; marci; mara; manager; mana; malcom;
      malcolm; maint; main; mail; magnet; magic; maggot; macro; mack;
      macintosh; macintos; machine; M$; lynne; lynn; lust; luke; lude; lucy;
      lucus; luck; lover; lovebug; love; louis; loser; lorraine; lorin;
      lori; lore; loose; lolopc; lol; lois; logout; loginwor; loginpass;
      Login; login; logic; lockword; lockout; lock; LOCAL; load; liz; live;
      literatu; lisp; lisa; lips; lion; linux; link; linda; limited;
      limbaugh; lima; lightsab; light; life; licker; lick; library; liberal;
      lexluthe; lewis; letmein; leslie; lesbian; leroy; leland; legal;
      leftwing; left; leet; lee; lebesgue; leah; lazer; lazarus; lava;
      laura; laser; larry; larkin; lara; laptop; lana; lan; lamination;
      laminati; lambda; lakers; ladle; ladies; l33t; l337; kristy; kristine;
      kristin; kristie; kristi; kristen; krista; known; knightma; knight;
      knife; klingon; kitten; kissmyas; kiss; kirkland; kirk; king;
      kimberly; kim; kilo; killthem; killer; kill; kids; kiddie; keyword;
      keyin; keybord; key; kewl; kevin; kerry; kerrie; kerri; kernel;
      kermit; keri; kelly; katrina; katina; katie; kathy; kathrine;
      kathleen; kate; katana; karina; karie; karen; kaka; jupiter; june;
      juliet; julie; julia; juicy; juggle; judy; judith; joyce; joy;
      journal; joshua; joseph; johnny; johndoe; john; joe; jody; joanne;
      joan; jixian; jill; jewelry; jester; jessica; jerusale; jerry; jenny;
      jennifer; jenni; jen; jeff; jeanne; jean; jazz; java; jasmin; japan;
      janie; janice; janet; jane; jail; jackie; isis; irule; irishman;
      irene; Inviter; invent; intranet; internet; Internet; integer; inside;
      input; innocuous; innocuou; inna; ingrid; ingress; ingres; indians;
      indiana; indian; india; include; imperial; immortal; imbroglio;
      imbrogli; image; illumina; ihavenopass; icecream; ibm; ian; hypertxt;
      hyper; hydrogen; hutchins; hunter; hunt; http; hq; hotel; hotdog;
      host; horus; horse; horror; horrible; horny; hooters; hooker; honey;
      homework; homeuser; homer; homepage; home; hollywoo; holly; hole; ho;
      hits; hitler; highland; high; hidden; hibernia; hiawatha; hexadeci;
      hewlett; heroin; hero; herbert; herb; help; hello; hell; heinlein;
      heidi; hebrides; heaven; heather; heathen; heat; headoffice; headbang;
      head; haxing; hax0r; hax; hawaii; haven; hate; harvey; harold;
      harmony; harddriv; hardcore; hard; happening; happenin; handjob;
      handily; handel; hamster; hamlet; hallowee; hal; hair; hagar; hacker;
      hacked; hack; h4x1ng; h4x0ring; h4x0r1ng; guntis; gumption; guitar;
      Guest; GUEST; guest; guessme; guess; gucci; guardian; gryphon; group;
      green; great; grant; grand; grahm; graham; grades; govermen; gouge;
      gosling; gorges; gorgeous; good; golfer; golf; golden; gold;
      godblessyou; god; gobo; gnu; glen; glacier; girl; ginger; gina;
      gigabyte; gibson; ghost; gertrude; germ; george; gauss; gatt;
      gatherin; gateway; Gast; garfield; gardner; games; gabriel; fungible;
      function; fun; FULL; fudge; fuckyou; fuckme; fucking; fucker; fucked;
      fuck; fubar; fryguy; frog; frighten; friends; friend; friday; french;
      freedom; free; freddy; fred; freak; frank; france; foxtrot; fourier;
      forsythe; fornicat; format; form; forever; foresight; foresigh; ford;
      force; football; foolproof; foolproo; fool; food; foobar; flowers;
      flower; florida; float; flakes; fishers; fish; firewall; fire; finite;
      FILES; file; fight; field; fidelity; ferrari; fermat; fender; felicia;
      feds; fear; fast; fart; faraday; farad; family; false; falcon; faith;
      fairway; extension; extensio; explosiv; explorer; explore; explode;
      expert; exchnge; exchange; evelyn; euclid; eternity; estate;
      establish; establis; ersatz; erotic; erin; erika; erica; eric;
      erenity; enzyme; enterprise; enterpri; enter; english; england;
      engineer; engine; enemy; enable; emmanuel; emily; emerald; email;
      ellen; elizabeth; elizabet; elephant; electron; elanor; elaine;
      einstein; einsiein; eileen; eiderdown; eiderdow; egghead; edwina;
      edwin; education; educatio; edu; edition; edit; edinburgh; edinburg;
      edges; eddie; echo; eatme; easy; easier; earth; eagle; eager; dyke;
      dungeon; duncan; dulce; duke; duelist; dudette; dude; dud3; duck;
      drought; drive; drdoom; dragon; dos; dope; doors; door; doonesbu;
      doomsday; doomii; doom2; doom; dong; donaldduck; domainpassword;
      domainpass; domain; dollar; dog; doctor; display; disney; diskette;
      disk; discovery; discover; disclose; discipli; disc; dirty; director;
      direct; dipshit; dinosaur; digital; dieter; diet; diehard; dick; dice;
      diane; diana; diamond; dial; devil; device; develop; desperate;
      desperat; desktop; desk; desiree; dennis; denise; democrat; demo;
      DEMO; deluge; delta; Dell; dell; defoe; Default; DEFAULT; default;
      deck; december; debug; deborah; debbie; deb; deathsta; death; dead;
      dbpassword; dbpass; db1234; db1; dawn; dave; databasepassword;
      databasepass; database; data; darkaven; dark; dapper; danny; danielle;
      daniel; dancer; dana; daisy; daemon; d00d; cynthia; cyberspa;
      cyberpun; cyber; customer; cunt; ctx; cshrc; crystal; cristina;
      criminal; crime; cretin; creosote; credit; creature; creation; create;
      cream; crash; crackpot; crack; cowboy; couscous; country; counters;
      correct; cornelius; corneliu; copy; cops; copper; cooper; cool;
      cookie; cookbook; cook; control; continue; console; conserva; connie;
      connect; condom; condo; comrades; comrade; computin; computer; compaq;
      company; commrades; commrade; commit; comics; combat; color; collins;
      cold; cola; coke; coin; coffee; codeword; codename; code; cock;
      cocainco; cocacola; coast; clusters; cluster; clinton; cleavage;
      claymore; claudia; classic; classes; class; cisco; cindy; cigarett;
      cigar; CHT; christy; christine; christina; christin; chris; chip;
      chester; chess; chemistry; chemistr; chem; CHECK; chat; charon;
      charming; charlie; charles; charity; Changeme; changeme; change;
      cerulean; celtics; celtic; celt; cecily; cayuga; cave; cathy;
      catholic; catherine; catherin; cat; castle; cash; cascades; carson;
      carrie; caroline; carolina; carole; carol; carmen; carla; caren;
      cardinal; card; capture; captain; capitol; cantor; candy; candi;
      camping; campanile; campanil; camille; californ; cad; butthead; butt;
      butch; burn; burgess; bung; bumbling; bullshit; bulls; bsd; brutefor;
      brute; brunette; bruce; brothel; broadway; bridget; brian; brenda;
      breast; break; bravo; brandy; brandi; bradley; boyscout; BOTH; born;
      book; boobs; boob; boner; bomb; bob; board; blues; blue; blowjob;
      blow; bloodaxe; blood; blondie; blonde; blank; black; bla; bitnet;
      bitmap; bitch; bishop; bird; bios; binary; billy; bill; bigfoot;
      bicameral; bicamera; bible; beverly; betty; betsie; beth; beta; beryl;
      berliner; berlin; berkeley; beowulf; benz; beloved; bell; behead;
      begin; beethoven; beethove; becky; beaver; beauty; beater; beast;
      bear; beammeup; beach; batman; batch; bassoon; bass; basic; baseball;
      bartman; bart; baritone; barf; bare; barber; barbara; banks; bank;
      bandit; bananas; banana; ball; bailey; badass; backup; BACKUP;
      backdoor; bacchus; baby; babe; azure; aztecs; authoriz; attack; atom;
      atmosphere; atmosphe; athena; asshole; asm; asian; asdfgh; asdf; asd;
      artist; arthur; arrow; army; arlene; ariadne; aria; april; apollo13;
      anything; anvils; anthropogenic; anthropo; anthrax; answer; anonymou;
      anon; annette; anne; anna; ann; anita; animals; animal; angie;
      angerine; angela; anfo; andy; andromache; andromac; android; andrea;
      anchor; anarchy; anarchis; analog; anal; amy; amorphous; amorphou;
      america; amber; amanda; amadeus; ama; alphabet; alpha; allow; allison;
      alison; alisa; alicia; alice; aliases; algebra; alf; Alexander;
      alexande; Alex; alex; alert; albert; albatross; albatros; albany;
      alaska; Al3x; airplane; aids; afro; aerobics; adult; adrianna; adrian;
      Administrator; ADMINISTRATOR; administrator; Administrateur;
      Administrador; EdmInistreiter; L'amministratore; oikeusministeri;
      forsterkning; administrada; administrat; admin123; Admin; ADMIN;
      admin; adm; adam; ada; accounts; accounting; account; access; ACCESS;
      accept; academic; academia; abcd; abc123; abc; aaa; 88888888; 654321;
      54321; 2600; 2003; 2002; 123qwe; 123asd; 123abc; 1234qwer; 123467890;
      12346789; 1234678; 123467; 12346; 123456789; 12345678; 1234567;
      123456; 12345; 1234; 123123; 123; 121212; 121; 12; 11111111; 111111;
      111; 110; 0wned; 0wn3d; 007; 00000000; 000000; 00000; 0000; 000; 00;
      !@; $%^&*; !@; $%^&; !@; $%^; !@; $%; !@; $



Generarea adreselor IP:
Creeaza adrese IP aleatoare, pastrand primul octet din propria adresa. Apoi incearca sa contacteze adresele create.


Activare de la distanta:
–Incearca sa activeze de la distanta malware-ul pe sistemul recent infectat. Pentru aceasta, apeleaza functia NetScheduleJobAdd.

 IRC Pentru a trimite informatii si pentru a fi controlat se conecteaza la serverul IRC:

Server: csos.**********
Port: 4961
Parola serverului: 146751dhzx
Canal: #100+
Nick: %combinatie de caractere aleatoare%
Parola: hzx



– Acest malware poate obtine si trimite infomatii cum ar fi:
    • Viteza procesorului
    • Utilizatorul curent
    • Spatiu liber pe disc
    • Memorie nealocata
    • Timpul de cand malware-ul a fost lansat in executie
    • Informatii despre retea
    • Informatii despre procesele sistemului
    • Cantitatea de memorie
    • Utilizator
    • Informatii despre sistemul de operare


– In plus, poate efectua urmatoarele operatii:
    • Lanseaza atacuri DDoS SYN
    • descarcare fisier
    • editare registru sistem
    • terminare proces
    • Porneste keylog
    • Se actualizeaza singur

 Fisiere host Fisierul

– Accesul la urmatoarele domenii este blocat:
   • www.symantec.com; securityresponse.symantec.com; symantec.com;
      pandasoftware.com; www.pandasoftware.com; www.sophos.com; sophos.com;
      www.mcafee.com; mcafee.com; downloads-us1.kaspersky-labs.com;
      updates1.kaspersky-labs.com; updates2.kaspersky-labs.com;
      updates3.kaspersky-labs.com; downloads1.kaspersky-labs.com;
      downloads2.kaspersky-labs.com; downloads3.kaspersky-labs.com;
      ftp.downloads1.kaspersky-labs.com; ftp.downloads2.kaspersky-labs.com;
      ftp.downloads3.kaspersky-labs.com; dnl-eu5.kaspersky-labs.com;
      liveupdate.symantecliveupdate.com; www.viruslist.com; viruslist.com;
      f-secure.com; www.f-secure.com; kaspersky.com; kaspersky-labs.com;
      www.avp.com; www.kaspersky.com; avp.com; www.networkassociates.com;
      networkassociates.com; www.ca.com; ca.com; mast.mcafee.com;
      my-etrust.com; www.my-etrust.com; download.mcafee.com;
      dispatch.mcafee.com; secure.nai.com; nai.com; www.nai.com;
      update.symantec.com; updates.symantec.com; us.mcafee.com;
      liveupdate.symantec.com; customer.symantec.com; rads.mcafee.com;
      trendmicro.com; www.trendmicro.com; www.grisoft.com; virustotal.com;
      www.virustotal.com; windowsupdate.microsoft.com; www.microsoft.com;
      microsoft.com; virusscan.jotti.org


 Backdoor Deschide portul

– %SYSDIR%\csos.exe pe portul TCP 113 Astfel se obtine control la distanta.

 Alte informatii Mutex:
Creeaza urmatorii mutecsi:
   • MUTEX_ID_01000001
   • csos

 Detaliile fisierului Limbaj de programare:
 Limbaj de programare folosit: C (compilat cu Microsoft Visual C++).


Compresia fisierului:
Pentru a ingreuna detectia si a reduce marimea fisierului, este folosit un program de compresie runtime.

Description inserted by Alexandru Dinu on Wednesday, October 3, 2007
Description updated by Andrei Gherman on Thursday, October 4, 2007

Back . . . .