BDS/VanBot.N - Backdoor Server

See also

Summary

Full description

Statistics

Virus:	BDS/VanBot.N
Date discovered:	21/09/2006
Type:	Worm
In the wild:	No
Reported Infections:	Low
Distribution Potential:	Medium
Damage Potential:	Medium
Static file:	Yes
File size:	91.648 Bytes
MD5 checksum:	559d68d3f45da4bbc74ebb8fd425ecf0
VDF version:	6.36.00.42 - Thu, 21 Sep 2006 07:59 (GMT+1)
IVDF version:	6.36.00.52 - Fri, 22 Sep 2006 15:02 (GMT+1)

General Method of propagation:
   • No own spreading routine

Aliases:
   • Mcafee: W32/Sdbot.worm!MS06-040
   • Kaspersky: Backdoor.Win32.VanBot.n
   • TrendMicro: WORM_SPYBOT.FC
   • Sophos: W32/Spybot-MK

Platforms / OS:
   • Windows 95
   • Windows 98
   • Windows 98 SE
   • Windows NT
   • Windows ME
   • Windows 2000
   • Windows XP
   • Windows 2003

Side effects:
   • Disable security applications
   • Registry modification
   • Third party control

Files It copies itself to the following location:
• %SYSDIR%\dllcache\grand.exe

It deletes the initially executed copy of itself.

Registry The following registry keys are added in order to load the service after reboot:

– HKLM\SYSTEM\CurrentControlSet\Services\Italian Grand Prix
   • "Type"=dword:00000110
   • "Start"=dword:00000002
   • "ErrorControl"=dword:00000000
   • "ImagePath"="%SYSDIR%\dllcache\grand.exe"
   • "DisplayName"="Italian Grand Prix"
   • "ObjectName"="LocalSystem"
   • "FailureActions"=%hex number%
   • "Description"="Italian Grand Prix."

– HKLM\SYSTEM\CurrentControlSet\Services\Italian Grand Prix\Enum
   • "0"="Root\LEGACY_ITALIAN_GRAND_PRIX\0000"
   • "Count"=dword:00000001
   • "NextInstance"=dword:00000001

The following registry keys are changed:

Deactivate Windows XP Firewall:
– HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess
   New value:
   • "Start"=dword:00000004

– HKLM\SYSTEM\CurrentControlSet\Services\wuauserv
   New value:
   • "Start"=dword:00000004

– HKLM\SYSTEM\CurrentControlSet\Control\Lsa
   New value:
   • "restrictanonymous"=dword:00000001
   • "lmcompatibilitylevel"=dword:00000001

– HKLM\SOFTWARE\Microsoft\Ole
   New value:
   • "EnableDCOM"="N"

Network Infection It uses the following login information in order to gain access to the remote machine:

– A list of usernames and passwords:
   • www; windows; web; visitor; test2; test1; test; temp; telnet; ruler;
      remote; real; random; qwerty; public; pub; private; poiuytre;
      password; passwd; pass; oracle; one; nopass; nobody; nick; newpass;
      new; network; monitor; money; manager; mail; login; internet; install;
      hello; guest; free; demo; default; debug; database; crew; computer;
      coffee; bin; beta; backup; backdoor; anonymous; anon; alpha; adm;
      access; abc123; abc; system; sys; super; sql; shit; shadow; setup;
      security; secure; secret; 123456789; 12345678; 1234567; 123456; 12345;
      1234; 123; 00000000; 0000000; 000000; 00000; 0000; 000; server;
      asdfgh; admin; root

Exploit:
It makes use of the following Exploits:
– MS02-061 (Elevation of Privilege in SQL Server Web)
– MS03-007 (Unchecked Buffer in Windows Component)
–MS06-040 (Vulnerability in Server Service)

Infection process:
Creates an FTP script on the compromised machine in order to download the malware to the remote location.

IRC To deliver system information and to provide remote control it connects to the following IRC Server:

Server: grand.hottest.**********
Port: 4915
Channel: #.vam.#
Nickname: [0]USA|%operating system%[P]%number%
Password: vnc

– Furthermore it has the ability to perform actions such as:
    • Download file
    • Join IRC channel
    • Open remote shell
    • Perform network scan
    • Start keylog
    • Start spreading routine
    • Updates itself

Process termination Processes with one of the following strings are terminated:
   • Ad-aware; spyware; hijack; kav; proc; norton; mcafee; f-pro; lockdown;
      firewall; blackice; avg; vsmon; zonea; spybot; nod32; reged; avp;
      troja; viru; anti

Processes containing one of the following window titles are terminated:
   • Ad-aware; spyware; hijack; kav; proc; norton; mcafee; f-pro; lockdown;
      firewall; blackice; avg; vsmon; zonea; spybot; nod32; reged; avp;
      troja; viru; anti

Backdoor The following port is opened:

– %SYSDIR%\dllcache\grand.exe on a random TCP port in order to provide an FTP server.

File details Runtime packer:
In order to aggravate detection and reduce size of the file it is packed with a runtime packer.

See a brief description here.

Description inserted by Ionut Slaveanu on Tue, 26 Sep 2006 15:00 (GMT+1)
Description updated by Andrei Ivanes on Fri, 20 Oct 2006 11:06 (GMT+1)

» About Malware
» About Phishing
» Viruses In the Wild

« back