Worm/Sdbot.134144.16 - Worm

See also

Summary

Full description

Statistics

Virus:	Worm/Sdbot.134144.16
Date discovered:	02/10/2006
Type:	Worm
In the wild:	No
Reported Infections:	Low
Distribution Potential:	Medium to high
Damage Potential:	Medium
Static file:	Yes
File size:	134.144 Bytes
MD5 checksum:	2e4800f2998357437866eafa292035b5
VDF version:	6.36.00.71
IVDF version:	6.36.00.86 - Mon, 09 Oct 2006 19:48 (GMT+1)

General Methods of propagation:
   • Local network
   • Messenger

Aliases:
   • Mcafee: W32/Sdbot.worm
   • Kaspersky: Backdoor.Win32.IRCBot.wo
   • TrendMicro: TSPY_GOLDUN.GH
   • F-Secure: Backdoor.Win32.IRCBot.wo
   • Sophos: W32/Vanebot-S
   • Grisoft: IRC/BackDoor.SdBot2.JSA
   • Eset: Win32/IRCBot.UH

Platforms / OS:
   • Windows 98
   • Windows 98 SE
   • Windows NT
   • Windows ME
   • Windows 2000
   • Windows XP
   • Windows 2003

Side effects:
   • Disable security applications
   • Lowers security settings
   • Records keystrokes
   • Registry modification
   • Steals information
   • Third party control

Files It copies itself to the following location:
• %SYSDIR%\dllcache\msiupdate32.exe

It deletes the initially executed copy of itself.

Registry The following registry keys are added in order to load the services after reboot:

– [HKLM\SYSTEM\CurrentControlSet\Services\Microsoft update Service]
   • "Type"=dword:00000110
   • "Start"=dword:00000002
   • "ErrorControl"=dword:00000000
   • "ImagePath"="%SYSDIR%\dllcache\msiupdate32.exe"
   • "DisplayName"="Microsoft update Service"
   • "ObjectName"="LocalSystem"
   • "FailureActions"=%hex values%
   • "Description"="Microsoft update Service."

– HKLM\SYSTEM\CurrentControlSet\Services\Microsoft update Service\
   Security]
   • "Security"=%hex values%

– [HKLM\SYSTEM\CurrentControlSet\Services\Microsoft update Service\
   Enum]
   • "0"="Root\\LEGACY_MICROSOFT_UPDATE_SERVICE\\0000"
   • "Count"=dword:00000001
   • "NextInstance"=dword:00000001

It creates the following entry in order to bypass the Windows XP firewall:

– [HKLM\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\
   FirewallPolicy\StandardProfile\AuthorizedApplications\List]
   • "%SYSDIR%\dllcache\msiupdate32.exe"="%SYSDIR%\dllcache\msiupdate32.exe:*:Enabled:Microsoft
      update Service"

The following registry keys are added:

– [HKLM\SOFTWARE\ProductName]
– [HKLM\SOFTWARE\ProductName\ProductID]

The following registry keys are changed:

Deactivate Windows XP Firewall:
– [HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess]
   Old value:
   • "Start"=%user defined settings%
   New value:
   • "Start"=dword:00000004

– [HKLM\SYSTEM\CurrentControlSet\Services\wuauserv]
   Old value:
   • "Start"=%user defined settings%
   New value:
   • "Start"=dword:00000004

– [HKLM\SOFTWARE\Microsoft\Ole]
   Old value:
   • "EnableDCOM"="Y"
   New value:
   • "EnableDCOM"="N"

– [HKLM\SYSTEM\CurrentControlSet\Control\Lsa]
   Old value:
   • "lmcompatibilitylevel"=dword:00000000
   • "restrictanonymous"=dword:00000000
   New value:
   • "lmcompatibilitylevel"=dword:00000001
   • "restrictanonymous"=dword:00000001

– [HKLM\SYSTEM\CurrentControlSet\Services\wscsvc]
   Old value:
   • "Start"=%user defined settings%
   New value:
   • "Start"=dword:00000004

– [HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate]
   Old value:
   • "DoNotAllowXPSP2"=%user defined settings%
   • "DoNotAllowXPSP3"=%user defined settings%
   New value:
   • "DoNotAllowXPSP2"=dword:00000001
   • "DoNotAllowXPSP3"=dword:00000001

Messenger It is spreading via Messenger. The characteristics are described below:

– AIM Messenger
– ICQ Messenger
– MSN Messenger
– Yahoo Messenger

Network Infection In order to ensure its propagation the malware attemps to connect to other machines as described below.

Exploit:
It makes use of the following Exploits:
– MS02-061 (Elevation of Privilege in SQL Server Web)
– MS04-007 (ASN.1 Vulnerability)
–MS06-040 (Vulnerability in Server Service)

IRC To deliver system information and to provide remote control it connects to the following IRC Server:

Server: dhl4.irc-sgo.**********
Port: 4523
Channel: #teddy#
Nickname: NICK [0]USA|%operating system%[P]%six-digit random character string%
Password: mymum

– Furthermore it has the ability to perform actions such as:
    • Launch DDoS SYN flood
    • Perform network scan
    • Start keylog
    • Updates itself

Process termination Processes with one of the following strings are terminated:
   • WindowsServer2003; Windows-XP; Windows-2000; Ad-aware; spyware;
      hijack; kav; proc; norton; mcafee; f-pro; lockdown; firewall;
      blackice; avg; vsmon; zonea; spybot; nod32; reged; avp; troja; viru;
      anti

List of services that are disabled:
   • Norton AntiVirus Auto Protect Service
   • Mcshield
   • Panda Antivirus
   • wuauserv
   • Windows Firewall
   • wscsvc

Backdoor The following ports are opened:

– msiupdate32.exe on a random TCP port in order to provide an FTP server.
– msiupdate32.exe on a random TCP port

Stealing It tries to steal the following information:

– A logging routine is started after a website is visited:
   • e-gold.com/srk.asp

– A logging routine is started after the following website is visited, which contains one of the following substrings in the URL:
   • bank
   • Bank
   • Wells Fargo
   • eBay
   • e-gold
   • iKobo
   • PayPal
   • StormPay
   • WorldPay
   • Western Union

– It captures:
    • Login information

Miscellaneous Mutex:
It creates the following Mutex:
• NSA

File patching:
In order to increase the number of maximum connections it has the capability to modify the tcpip.sys. It may result in a corruption of that file and break network connectivity.

File details Programming language:
The malware program was written in MS Visual C++.

Runtime packer:
In order to aggravate detection and reduce size of the file it is packed with a runtime packer.

See a brief description here.

Description inserted by Adriana Popa on Fri, 03 Nov 2006 14:52 (GMT+1)
Description updated by Adriana Popa on Fri, 03 Nov 2006 15:02 (GMT+1)

» About Malware
» About Phishing
» Viruses In the Wild

« back