Nume:Worm/Pushbot.7577
Descoperit pe data de:24/09/2009
Tip:Vierme
ITW:Da
Numar infectii raportate:Scazut spre mediu
Potential de raspandire:Scazut spre mediu
Potential de distrugere:Mediu
Fisier static:Da
Marime:75.776 Bytes
MD5:eea6cee9d7cb77adfc9ff7a544220d9c
Versiune IVDF:7.01.06.31 - Thursday, September 24, 2009

 General Metoda de raspandire:
• Functia autorun


Sistem de operare:
   • Windows 2000
   • Windows XP
   • Windows 2003


Efecte secundare:
   • Descarca fisiere malware
   • Creeaza fisiere malware
   • Reduce setarile de securitate
   • Modificari in registri

 Fisiere Se copiaza in urmatoarele locatii:
   • %WINDIR%\iexplorer7.exe
   • %unitate disc%\RECYCLER\%CLSID%\sysmngr32.exe



Sunt create fisierele:

– %WINDIR%\log32.txt
– %unitate disc%\autorun.inf Acesta este un fisier text care nu prezinta pericol si are urmatorul continut:
   • %cod care ruleaza fisierul malitios%

– %unitate disc%\RECYCLER\%CLSID%\Desktop.ini



Incearca sa descarce un fisier:

– Adresele sunt urmatoarele:
   • http://www.pr0.net/deny2/**********
   • http://www.sevy.eu.org/**********
   • http://www.proxysecurity.com/**********
   • http://www.proxy-heaven.com/**********
   • http://www.pr0.net/deny2/**********
   • http://www.cooleasy.com/**********
   • http://www.belgarion.com/images/**********
   • http://proxywoorld.ovh.org/**********
   • http://proxyworld.ifrance.com/**********
La momentul realizarii descrierii, acest fisier nu era disponibil pentru o analiza ulterioara.

 Registrii sistemului Una din urmatoarele valori este adaugata in registri pentru pornirea automata a procesului dupa reboot:

–  [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
   • "Microsoft Driver Setup"="%WINDIR%\iexplorer7.exe"



Se adauga in registrii sistemului:

– [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\
   Run]
   • "Microsoft Driver Setup"="%WINDIR%\iexplorer7.exe"



Urmatoarea cheie din registri este modificata:

– [HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\
   FirewallPolicy\StandardProfile]
   Noua valoare:
   • "EnableFirewall"=dword:0x00000000

 Messenger Se raspandeste prin messenger. Caracteristicile sunt:

– MSN Messenger


Catre:
Toate intrarile din lista de contacte.

 Reţea Exploit:
Foloseste urmatoarele vulnerabilitati:
– MS03-007 (Unchecked Buffer in Windows Component)
– MS03-039 (Buffer Overrun in RPCSS Service)
–MS06-040 (Vulnerability in Server Service)

 IRC Pentru a trimite informatii si pentru a fi controlat se conecteaza la serverele IRC:

Server: login.i**********.org.uk
Port: 47221
Canal: #e10
Nick: [N00_USA_XP_%numar%]%combinatie de caractere aleatoare%

Server: login.i**********.co.uk
Port: 47221
Canal: #e10
Nick: [N00_USA_XP_%numar%]%combinatie de caractere aleatoare%

Server: login.in**********.com
Port: 47221
Canal: #e10
Nick: [N00_USA_XP_%numar%]%combinatie de caractere aleatoare%

Server: myip.wo**********.net
Port: 47221
Canal: #e10
Nick: [N00_USA_XP_%numar%]%combinatie de caractere aleatoare%

Server: ip.w**********.com
Port: 47221
Canal: #e10
Nick: [N00_USA_XP_%numar%]%combinatie de caractere aleatoare%


– In plus, poate efectua urmatoarele operatii:
    • descarcare fisier
    • executarea unui fisier
    • Scaneaza reteaua
    • Se actualizeaza singur

 Terminarea proceselor Lista cu procesele oprite:
   • VIPRE.EXE; ISSDM_EN_32.EXE; P08PROMO.EXE; K7TS_SETUP.EXE;
      AVINSTALL.EXE; WITSETUP.EXE; TrendMicro_TISPro_16.1_1063_x32.EXE;
      VBA32-PERSONAL-LATEST-ENGLISH.EXE; CCSETUP210.EXE; FSMB32.EXE;
      FSGK32.EXE; FSAV95.EXE; FSAV530WTBYB.EXE; FSAV530STBYB.EXE;
      FSAV32.EXE; FSAV.EXE; FSAA.EXE; FPROT.EXE; FP-WIN.EXE; FNRB32.EXE;
      FIH32.EXE; FCH32.EXE; FAST.EXE; FAMEH32.EXE; F-STOPW.EXE;
      F-PROT95.EXE; F-PROT.EXE; AFMAIN.EXE; SPIDERUI.EXE; SPIDERNT.EXE;
      ALERTMAN.EXE; RAVMOND.EXE; MAKEREPORT.EXE; BOXMOD.EXE; 360SAFE.EXE;
      360RPT.EXE; 360HOTFIX.EXE; 360TRAY.EXE; NSVMON.NPC; NSAVSVC.NPC;
      NPCGREENAGENT.NPC; PUSCAN.EXE; AYSERVICENT.AYE; AYAGENT.AYE;
      CMDAGENT.EXE; CPF.EXE; VSMON.EXE; ZLCLIENT.EXE; NSUTILITY.EXE;
      NSPUPDT.EXE; NAVQSCAN.EXE; NSPMAIN.EXE; NSPUPSVC.EXE; NSPSVC.EXE;
      MKSADMINCONSOLE.EXE; MKSUPDATE.EXE; MKSPC.EXE; MKSFWALL.EXE;
      MKSVIRMONSVC.EXE; MKS_SCAN.EXE; MKS_MAIL.EXE; MKSREGMON.EXE;
      KAVPFW.EXE; KASMAIN.EXE; KAV32.EXE; KPFWSVC.EXE; KISSVC.EXE;
      KWATCH.EXE; KPFW32.EXE; KAVSTART.EXE; KVSRVXP.EXE; KVOL.EXE; KVXP.KXP;
      KVMONXP.KXP; CAVASM.EXE; CMAIN.EXE; ARCABIT.CORE.LOGGINGSERVICE.EXE;
      ARCABIT.CORE.CONFIGURATOR2.EXE; TASKSCHEDULER.EXE; UPDATE.EXE;
      NETMONSV.EXE; FILEMONSV.EXE; ABREGMON.EXE.EXE; ARCACHECK.EXE;
      ARCAVIR.EXE; AVMENU.EXE; A2HIJACKFREE.EXE; A2SERVICE.EXE; A2START.EXE;
      A2SCAN.EXE; A2GUARD.EXE; VRFWSVC.EXE; HFACSVC.EXE; VRMONSVC.EXE;
      HPCSVC.EXE; HSVCMOD.EXE; VRMONNT.EXE; MKSTRAY.EXE; VBA32ADS.EXE;
      VBA32LDR.EXE; FILELOCKSETUP.EXE; TSCFCOMMANDER.EXE; TMPROXY.EXE;
      TMPFW.EXE; TMBMSRV.EXE; UFNAVI.EXE; UFSEAGNT.EXE; TISSPWIZ.EXE;
      SFCTLCOM.EXE; TNBUTIL.EXE; DEFWATCH.EXE; RTVSCAN.EXE; SBAMSVC.EXE;
      SBAMUI.EXE; SBAMTRAY.EXE; SAVADMINSERVICE.EXE; SAVSERVICE.EXE;
      SCFSERVICE.EXE; SCFMANAGER.EXE; RAVTASK.EXE; CCENTER.EXE; ULIBCFG.EXE;
      RAVLITE.EXE; PCTAV.EXE; PCTAVSVC.EXE; PXCONSOLE.EXE; PXAGENT.EXE;
      RAV.EXE; PCTSAUXS.EXE; PCTSTRAY.EXE; PCTSSVC.EXE; PCTSGUI.EXE;
      AVGAS.EXE; PAVBCKPT.EXE; WEBPROXY.EXE; PAVSRV51.EXESRVLOAD.EXE;
      PSIMSVC.EXE; PSHOST.EXE; AVENGINE.EXE; PSKMSSVC.EXE; PAVPRSRV.EXE;
      PAVFNSVR.EXE; PSCTRLS.EXE; TPSRV.EXE; NOD32M2.EXE; NOD32CC.EXE;
      NOD32.EXE; NMAIN.EXE; NOD32KUI.EXE; MSASCUI.EXE; MSMPENG.EXE;
      MCUPDATE.EXE; MCSHIELD.EXE; MCVSSHLD.EXE; MCVSRTE.EXE; MCAGENT.EXE;
      KAVSVC.EXE; KAV.EXE; K7TSMNGR.EXE; K7SPMSRC.EXE; K7RTSCAN.EXE;
      K7PSSRVC.EXE; K7FWSRVC.EXE; K7EMLPXY.EXE; K7TSECURITY.EXE;
      K7SYSTRY.EXE; VIRUSUTILITIES.EXE; GUARDXSERVICE.EXE;
      GUARDXKICKOFF.EXE; AVKWCTL.EXE; AVKTUNERSERVICE.EXE; AVKSERVICE.EXE;
      GDFWSVC.EXE; AVKPROXY.EXE; GDFIRE~1.EXE; AVKTRAY.EXE;
      GDFIREWALLTRAY.EXE; FSAUA.EXE; NOD32KRN.EXE; FSMA32.EXE; FSDFWD.EXE;
      FSGK32ST.EXE; FSM32.EXE; FPWIN.EXE; FPAVSERVER.EXE; FPROTTRAY.EXE;
      INICIO.EXE; UMXPOL.EXE; UMXFWHLP.EXE; UMXAGENT.EXE; UMXCFG.EXE;
      PPCLTPRIV.EXE; SVCPRS32.EXE; ITMRTSVC.EXE; CCPROVSP.EXE; MDMCLS32.EXE;
      CAGLOBALLIGHT.EXE; CAPFUPGRADE.EXE; CAPFASEM.EXE; CAFW.EXE;
      CFGMNG32.EXE; CCTRAY.EXE; CLAMTRAY.EXE; CLAMWIN.EXE; ALSVC.EXE;
      ALMON.EXE; DRWEBSCD.EXE; SPIDERML.EXE; DRWEB32W.EXE; ACS.EXE;
      STRTSVC.EXE; OP_MON.EXE; SENSOR.EXE; QHFW332.EXE; CATEYE.EXE;
      ONLNSVC.EXE; EMLPROUI.EXE; UPSCHD.EXE; SCANMSG.EXE; SCANWSCS.EXE;
      EMLPROXY.EXE; ONLINENT.EXE; ASWCLNR.EXE; BDAGENT.EXE; VSSERV.EXE;
      LIVESRV.EXE; XCOMMSVR.EXE; UISCAN.EXE; BDSS.EXE; AVGUI.EXE;
      AVGUPD.EXE; AVGSCANX.EXE; AVGEMC.EXE; AVGUPSVC.EXE; AVGAMSVR.EXE;
      AVGWDSVC.EXE; ASHWEBSV.EXE; ASHMAISV.EXE; ASWUPDSV.EXE; ASHSERV.EXE;
      ASHDISP.EXE; AVCENTER.EXE; SCHED.EXE; AVIRARKD.EXE; AVGNT.EXE;
      AVGUARD.EXE; AHNSDSV.EXE; ACAIS.EXE; ACALS.EXE; ACAEGMGR.EXE;
      ACAAS.EXE; QOELOADER.EXE; APVXDWIN.EXE; QUHLPSVC.EXE; 123.EXE;
      RAVP.EXEMBAM.EXE123.COM; UNLOCKER1.8.7.EXE; UNIEXTRACT.EXE;
      SYSANALYZER_SETUP.EXE; STARTDRECK.EXE; SPF.EXE; REGX2.EXE;
      REGSHOT.EXE; REGSCANNER.EXE; REGISTRAR_LITE.EXE; REGCOOL.EXE;
      REGALYZ.EXE; PROJECTWHOISINSTALLER.EXE; PROCMON.EXE; CUREIT.EXE;
      FIXBAGLE.EXE; PGSETUP.EXE; OBJMONSETUP.EXE; NETALYZ.EXE; KILLBOX.EXE;
      INSTALLWATCHPRO25.EXE; AVENGER.EXE; IEFIX.EXE; HOSTSFILEREADER.EXE;
      FIXPATH.EXE; FILEFIND.EXE; FILEALYZ.EXE; EULALYZERSETUP.EXE;
      A2HIJACKFREESETUP.EXE; DLLCOMPARE.EXE; CPROCESS.EXE; CPORTS.EXE;
      ASVIEWER.EXE; APT.EXE; APM.EXE; WIRESHARK.EXE; SPYBOTSD.EXE;
      TEATIMER.EXE; SPYBOTSD160.EXE; PROCESSMONITOR.EXE; PROCDUMP.EXE;
      PG2.EXE; LORDPE.EXE; ICESWORD.EXE; REANIMATOR.EXE; ROOTKITNO.EXE;
      RKD.EXE; HACKMON.EXE; UNHACKME.EXE; ROOTKIT_DETECTIVE.EXE;
      AVGARKT.EXE; FSB.EXE; FSBL.EXE; ROOTKITREVEALER.EXE; PSKILL.EXE;
      TASKMON.EXE; TASKLIST.EXE; TASKMAN.EXE; PROCEXP.EXE; MSNFIX.EXE;
      HIJACKTHIS_V2.EXE; HIJACKTHIS.EXE; HIJACKTHIS_SFX.EXE; HJTSETUP.EXE;
      HJTINSTALL.EXE; OLLYDBG.EXE; NETSTAT.EXE; PORTMONITOR.EXE;
      PORTDETECTIVE.EXE; FPORT.EXE; APORTS.EXE; PAVARK.EXE; DARKSPY105.EXE;
      HELIOS.EXE; ROOTKITBUSTER.EXE; ROOTALYZER.EXE; BC5CA6A.EXE; SEEM.EXE;
      DELAYDELFILE.EXE; DUBATOOL_AV_KILLER.EXE; SUPERKILLER.EXE;
      KAKASETUPV6.EXE; BUSCAREG.EXE; MSNCLEANER.EXE; SRESTORE.EXE;
      BOOTSAFE.EXE; SUPERANTISPYWARE.EXE; CCLEANER.EXE;
      REGUNLOCKER.EXETSNTEVAL.EXEXP_TASKMGRENAB.EXE; CF9409.EXE; GMER.EXE;
      CATCHME.EXE; SDFIX.EXE; COMBOFIX.EXE; SRENGPS.EXE; AUTORUNS.EXE;
      TASKKILL.EXE; REGEDIT.EXE; REG.EXE; MYPHOTOKILLER.EXE;
      KILLAUTOPLUS.EXE; FOLDERCURE.EXE; REGEDIT.SCR; REGEDIT.COM; MMC.EXE;
      TCPVIEW.EXE; LISTO.EXE; GUARD.EXE; NTVDM.EXE; COMMAND.COM;
      COMBOFIX.COM; COMBOFIX.SCR; COMBOFIX.BAT; REGMON.EXE;
      OTMOVEIT.EXEMBAM-SETUP.EXE; JAJA.EXE; AVZ.EXE; MBAM.EXE;
      MBAM-SETUP.EXE; PENCLEAN.EXE; ELISTA.EXE; HJ.EXE;
      WINDOWS-KB890930-V2.2.EXE; MRTSTUB.EXE; MRT.EXE; HIJACK-THIS.EXE;
      VIRUS.EXE; SAFEBOOTKEYREPAIR.EXEOTMOVEIT3.EXEHOSTSXPERT.EXEDAFT.EXE;
      ATF-CLEANER.EXE; COMPAQ_PROPIETARIO.EXE; SRENGLDR.EXE; HOOKANLZ.EXE


 Detaliile fisierului Compresia fisierului:
Pentru a ingreuna detectia si a reduce marimea fisierului, este folosit un program de compresie runtime.

Description inserted by Petre Galan on Thursday, February 4, 2010
Description updated by Petre Galan on Friday, February 5, 2010

Back . . . .