Virus:Worm/Sdbot.gen
Date discovered:25/01/2007
Type:Worm
In the wild:No
Reported Infections:Low
Distribution Potential:Medium
Damage Potential:Medium
Static file:No
Engine version:7.03.00.32

 General Methods of propagation:
   • Local network
   • Mapped network drives

Similar detection:
   •  Worm/Rbot.gen


Platforms / OS:
   • Windows 95
   • Windows 98
   • Windows 98 SE
   • Windows NT
   • Windows ME
   • Windows 2000
   • Windows XP
   • Windows 2003


Side effects:
   • Registry modification
   • Makes use of software vulnerability
   • Third party control

 Special detection  Worm/Sdbot.gen

Description:
A generic detection routine designed to detect common family characteristics shared in several variants.

This special detection routine was developed in order to detect unknown variants and will be enhanced continuously.

 IRC – This malware has the ability to collect and send information such as:
    • Cached passwords
    • Capture screen
    • Capture shot from webcam
    • CPU speed
    • Current user
    • Free disk space
    • Free memory
    • Malware uptime
    • Information about the network
    • Information about running processes
    • Size of memory
    • Information about the Windows operating system


– Furthermore it has the ability to perform actions such as:
    • connect to IRC server
    • Launch DDoS ICMP flood
    • Launch DDoS SYN flood
    • Launch DDoS TCP flood
    • Launch DDoS UDP flood
    • Disable DCOM
    • Disable network shares
    • disconnect from IRC server
    • Download file
    • Edit registry
    • Enable DCOM
    • Enable network shares
    • Execute file
    • Join IRC channel
    • Kill process
    • Leave IRC channel
    • Open remote shell
    • Perform DDoS attack
    • Perform network scan
    • Perform port redirection
    • Restart system
    • Send emails
    • Start keylog
    • Start spreading routine
    • Terminate process
    • Updates itself
    • Upload file
    • Visit a website

Description inserted by Andrei Ivanes on Thursday, October 18, 2007
Description updated by Andrei Ivanes on Thursday, October 18, 2007

Back . . . .