TR/IRCBot.36864.6 - Trojan

See also

Summary

Full description

Statistics

Virus:	TR/IRCBot.36864.6
Date discovered:	27/10/2006
Type:	Trojan
In the wild:	No
Reported Infections:	Low
Distribution Potential:	Low
Damage Potential:	Medium
Static file:	Yes
File size:	36.864 Bytes
MD5 checksum:	e9e2e113fdf03154593a6881c275f7b9
VDF version:	6.36.01.136
IVDF version:	6.36.01.144 - Thu, 07 Dec 2006 10:12 (GMT+1)

General Method of propagation:
   • No own spreading routine

Aliases:
   • Mcafee: BackDoor-CMQ
   • Kaspersky: Trojan-Proxy.Win32.Horst.pg
   • TrendMicro: TROJ_HORST.HI
   • F-Secure: Trojan-Proxy.Win32.Horst.pg
   • Eset: Win32/Medbot.BW

It was previously detected as:
   • Worm/IRCBot.36864.6

Platforms / OS:
   • Windows 98
   • Windows 98 SE
   • Windows NT
   • Windows ME
   • Windows 2000
   • Windows XP
   • Windows 2003

Side effects:
   • Downloads a file
   • Registry modification
   • Third party control

Files It copies itself to the following locations:
   • %SYSDIR%\smss.exe
   • %malware execution directory%\smssb.exe

It tries to download some files:

– The location is the following:
   • http://up.medbod.com/up/**********
At the time of writing this file was not online for further investigation.

– The location is the following:
   • http://up.medbod.com/up/**********
It is saved on the local hard drive under: %TEMPDIR%\upd%three-digit random character string%.exe Furthermore this file gets executed after it was fully downloaded. At the time of writing this file was not online for further investigation.

Registry The following registry key is added in order to run the process after reboot:

– [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
   • ".nvsvc"="%SYSDIR%\smss.exe /w"

The value of the following registry key is removed:

– [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
   • "KAVPersonal50"

The following registry key is changed:

– [HKLM\SYSTEM\CurrentControlSet\Services\wuauserv]
   New value:
   • "Start"=dword:00000004

IRC To deliver system information and to provide remote control it connects to the following IRC Servers:

Server: news.zabaren.**********
Port: 80
Nickname: jega-1_%four-digit random character string%_%four-digit random character string%

Server: in.lorenim.**********
Port: 80
Nickname: jega-1_%four-digit random character string%_%four-digit random character string%

Server: sys.medarun.**********
Port: 80
Nickname: jega-1_%four-digit random character string%_%four-digit random character string%

– Furthermore it has the ability to perform actions such as:
• Download file
• Execute file

Process termination List of services that are disabled:
   • wuauserv
   • nava
   • psvc
   • Symantec Core LC
   • SAVScan
   • kavsvc
   • wscsvc

Backdoor Contact server:
The following:
• dl.medbod.**********:1900(UDP)

As a result it may send some information.

Injection – It injects itself into a process.

    Process name:
   • svchost.exe

   If successful, the malware process terminates while the injected part remains active.

Miscellaneous Mutex:
It creates the following Mutex:
• 3645FBCD-ECD2-23D0-BAC4-00DE453DEF6B

File details Programming language:
The malware program was written in MS Visual C++.

Runtime packer:
In order to aggravate detection and reduce size of the file it is packed with the following runtime packer:
• UPX

See a brief description here.

Description inserted by Adriana Popa on Tue, 05 Dec 2006 13:30 (GMT+1)
Description updated by Adriana Popa on Thu, 07 Dec 2006 11:54 (GMT+1)

» About Malware
» About Phishing
» Viruses In the Wild

« back