Nume: Worm/Rbot.alt Descoperit pe data de: 28/12/2005 Tip: Vierme ITW: Da Numar infectii raportate: Scazut Potential de raspandire: Mediu Potential de distrugere: Mediu Fisier static: Da Marime: 259.072 Bytes MD5: be2f1a6e5257cf7bd3a9597c7943c140 Versiune VDF: 6.33.00.73
General Metoda de raspandire: • Reteaua locala Alias: • Symantec: W32.Spybot.Worm • Kaspersky: Backdoor.Win32.Rbot.alt • TrendMicro: WORM_SDBOT.CTV • F-Secure: Backdoor.Win32.Rbot.alt • Sophos: W32/Rbot-BZN • Panda: W32/Sdbot.GES.worm • VirusBuster: Worm.Rbot.DGN • Bitdefender: Backdoor.Rbot.ALT Sistem de operare: • Windows 95 • Windows 98 • Windows 98 SE • Windows NT • Windows 2000 • Windows XP • Windows 2003 Efecte secundare: • Reduce setarile de securitate • Modificari in registri • Profita de vulnerabilitatile softului • Posibilitatea accesului neautorizat la computer Fisiere Se copiaza in urmatoarea locatie: • %SYSDIR%\MStools1.exe Sterge copia initiala a virusului. Registrii sistemului Urmatoarele chei sunt adaugate in registri, in mod repetat, pentru a asigura pornirea procesului dupa reboot. – HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run • "Microsoft Service TOols"="MStools1.exe" – HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices • "Microsoft Service TOols"="MStools1.exe" – HKCU\Software\Microsoft\Windows\CurrentVersion\Run • "Microsoft Service TOols"="MStools1.exe" – HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices • "Microsoft Service TOols"="MStools1.exe" Urmatoarele chei sunt adaugate in registrii sistemului: – HKLM\SOFTWARE\Microsoft\Ole • "Microsoft Service TOols"="MStools1.exe" – HKLM\SYSTEM\CurrentControlSet\Control\Lsa • "Microsoft Service TOols"="MStools1.exe" – HKCU\Software\Microsoft\OLE • "Microsoft Service TOols"="MStools1.exe" – HKCU\SYSTEM\CurrentControlSet\Control\Lsa • "Microsoft Service TOols"="MStools1.exe" Reţea Pentru a-si asigura raspandirea, programul malware incearca sa contacteze alte sisteme, asa cum este descris in continuare: Creeaza copii malware in urmatoarele share-uri de retea: • IPC$ • C$ • ADMIN$ Foloseste urmatoarele date de logare, pentru a controla sistemul la distanta: – Lista de utilizatori si parole: • intranet; lan; main; winpass; blank; office; control; nokia; siemens; compaq; dell; cisco; ibm; orainstall; sqlpassoainstall; sql; db1234; db1; databasepassword; data; databasepass; dbpassword; dbpass; access; domainpassword; domainpass; domain; hello; hell; god; sex; slut; bitch; fuck; exchange; backup; technical; loginpass; login; mary; katie; kate; george; eric; chris; ian; neil; lee; brian; susan; sue; sam; luke; peter; john; mike; bill; fred; joe; jen; bob; qwe; zxc; asd; qaz; win2000; winnt; winxp; win2k; win98; windows; oeminstall; oemuser; oem; user; homeuser; home; accounting; accounts; internet; www; web; outlook; mail; qwerty; null; server; system; changeme; linux; unix; demo; none; test; 2004; 2002; 2001; 2000; 1234567890; 123456789; 12345678; 1234567; 123456; 12345; 1234; 123; 007; pwd; pass; pass1234; passwd; password; password1; adm; db2; oracle; dba; database; default; guest; wwwadmin; teacher; student; owner; computer; staff; admins; administrat; administrateur; administrador; administrator Exploit: Foloseste urmatoarele vulnerabilitati: – MS02-061 (Elevation of Privilege in SQL Server Web) – MS03-026 (Buffer Overrun in RPC Interface) – MS03-039 (Buffer Overrun in RPCSS Service) – MS03-049 (Buffer Overrun in the Workstation Service) – MS04-007 (ASN.1 Vulnerability) – MS04-011 (LSASS Vulnerability) Generarea adreselor IP: Creeaza adrese IP aleatoare, pastrand doar primii doi octeti din propria adresa. Apoi incearca sa contacteze adresele create. Procesul de infectare: Creeaza un script TFTP sau FTP pe masina afectata, pentru a descarca malware la distanta, pe un alt sistem. Activare de la distanta: –Incearca sa activeze de la distanta malware-ul pe sistemul recent infectat. Pentru aceasta, apeleaza functia NetScheduleJobAdd. IRC Pentru a trimite informatii si pentru a fi controlat se conecteaza la serverul IRC: Server: po1.exceed-********** Port: 6522 Parola serverului: supersecret Canal: #superbawts# Nick: [}{]%sir de 6 caractere aleatoare% Parola: superbots – Acest malware poate obtine si trimite infomatii cum ar fi: • Viteza procesorului • Informatii despre drivere • Spatiu liber pe disc • Memorie nealocata • Informatii despre retea • Informatii despre procesele sistemului • Cantitatea de memorie • Utilizator • Informatii despre sistemul de operare – In plus, poate efectua urmatoarele operatii: • Lanseaza atacuri DDoS ICMP • Lanseaza atacuri DDoS SYN • Lanseaza atacuri DDoS TCP • Lanseaza atacuri DDoS UDP • dezactivare DCOM • dezactivarea partajarii de resurse in retea • descarcare fisier • activare DCOM • activarea partajarii de resurse in retea • executarea unui fisier • intrare pe canal IRC • terminare proces • parasire canal IRC • deschidere consola • executare atac DDoS • Scaneaza reteaua • redirectionare porturi • repornirea sistemului • trimitere email-uri • Porneste keylog • Porneste rutina de raspandire • terminare proces malware • terminare proces • Se actualizeaza singur • Face upload la un fisier • Vizitarea unui website Terminarea proceselor Lista cu procesele oprite: • _AVP32.EXE; _AVPCC.EXE; _AVPM.EXE; ACCWIZZ.EXE; ACCWIZZZ.EXE; ACKWIN32.EXE; ADAWARE.EXE; ADVXDWIN.EXE; AGENTSVR.EXE; AGENTW.EXE; ALERTSVC.EXE; ALEVIR.EXE; ALOGSERV.EXE; AMON9X.EXE; ANTI-TROJAN.EXE; ANTIVIRUS.EXE; ANTS.EXE; APIMONITOR.EXE; APLICA32.EXE; APVXDWIN.EXE; ARR.EXE; ATCON.EXE; ATGUARD.EXE; ATRO55EN.EXE; ATUPDATER.EXE; ATWATCH.EXE; AU.EXE; AUPDATE.EXE; AUTODOWN.EXE; AUTO-PROTECT.NAV80TRY.EXE; AUTOTRACE.EXE; AUTOUPDATE.EXE; AVCONSOL.EXE; AVE32.EXE; AVGCC32.EXE; AVGCTRL.EXE; AVGNT.EXE; AVGSERV.EXE; AVGSERV9.EXE; AVGUARD.EXE; AVGW.EXE; AVKPOP.EXE; AVKSERV.EXE; AVKSERVICE.EXE; AVKWCTl9.EXE; AVLTMAIN.EXE; AVNT.EXE; AVP.EXE; AVP32.EXE; AVPCC.EXE; AVPDOS32.EXE; AVPM.EXE; AVPTC32.EXE; AVPUPD.EXE; AVSCHED32.EXE; AVSYNMGR.EXE; AVWINNT.EXE; AVWUPD.EXE; AVWUPD32.EXE; AVWUPSRV.EXE; AVXMONITOR9X.EXE; AVXMONITORNT.EXE; AVXQUAR.EXE; BACKWEB.EXE; BARGAINS.EXE; BD_PROFESSIONAL.EXE; BEAGLE.EXE; BELT.EXE; BIDEF.EXE; BIDSERVER.EXE; BIPCP.EXE; BIPCPEVALSETUP.EXE; BISP.EXE; BLACKD.EXE; BLACKICE.EXE; BLSS.EXE; BOOTCONF.EXE; BOOTWARN.EXE; BORG2.EXE; BOTZOR.EXE; BPC.EXE; BRASIL.EXE; BS120.EXE; BUNDLE.EXE; BVT.EXE; CCAPP.EXE; CCEVTMGR.EXE; CCPXYSVC.EXE; CDP.EXE; CFD.EXE; CFGWIZ.EXE; CFIADMIN.EXE; CFIAUDIT.EXE; CFINET.EXE; CFINET32.EXE; CLAW95CF.EXE; CLEAN.EXE; CLEANER.EXE; CLEANER3.EXE; CLEANPC.EXE; CLICK.EXE; CMD.EXE; CMD32.EXE; CMESYS.EXE; CMGRDIAN.EXE; CMON016.EXE; CONNECTIONMONITOR.EXE; CPD.EXE; CPF9X206.EXE; CPFNT206.EXE; CSM.EXE; CTRL.EXE; CV.EXE; CWNB181.EXE; CWNTDWMO.EXE; DATEMANAGER.EXE; DCOMX.EXE; DEFALERT.EXE; DEFSCANGUI.EXE; DEFWATCH.EXE; DEPUTY.EXE; DIVX.EXE; DLLCACHE.EXE; DLLREG.EXE; DOORS.EXE; DPF.EXE; DPFSETUP.EXE; DPPS2.EXE; DRWATSON.EXE; DRWEB32.EXE; DRWEBUPW.EXE; DSSAGENT.EXE; DVP95.EXE; DVP95_0.EXE; ECENGINE.EXE; EFPEADM.EXE; EMSW.EXE; ENT.EXE; ESAFE.EXE; ESCANHNT.EXE; ESCANV95.EXE; ESPWATCH.EXE; ETHEREAL.EXE; ETRUSTCIPE.EXE; EVIL.EXE; EVPN.EXE; EXANTIVIRUS-CNET.EXE; EXE.AVXW.EXE; EXPERT.EXE; EXPLORE.EXE; FAMEH32.EXE; FAST.EXE; FCH32.EXE; FIH32.EXE; FINDVIRU.EXE; FIREWALL.EXE; FNRB32.EXE; FPROT.EXE; F-PROT.EXE; F-PROT95.EXE; FP-WIN.EXE; FP-WIN_TRIAL.EXE; FRW.EXE; FSAA.EXE; FSAV.EXE; FSAV32.EXE; FSAV530STBYB.EXE; FSAV530WTBYB.EXE; FSAV95.EXE; FSGK32.EXE; FSM32.EXE; FSMA32.EXE; FSMB32.EXE; F-STOPW.EXE; FUCK.EXE; GATOR.EXE; GBMENU.EXE; GBPOLL.EXE; GENERICS.EXE; GMT.EXE; GUARD.EXE; GUARDDOG.EXE; HACKTRACERSETUP.EXE; HBINST.EXE; HBSRV.EXE; HOTACTIO.EXE; HOTPATCH.EXE; HPSV.EXE; HTLOG.EXE; HTPATCH.EXE; HWPE.EXE; HXDL.EXE; HXIUL.EXE; IAMAPP.EXE; IAMSERV.EXE; IAMSTATS.EXE; IBMASN.EXE; IBMAVSP.EXE; ICLOADNT.EXE; ICMON.EXE; ICSUPP95.EXE; ICSUPPNT.EXE; IDLE.EXE; IEDLL.EXE; IEDRIVER.EXE; IEXPLORER.EXE; IFACE.EXE; IFW2000.EXE; INETLNFO.EXE; INFUS.EXE; INFWIN.EXE; INIT.EXE; INTDEL.EXE; INTREN.EXE; IOMON98.EXE; ISTSVC.EXE; JAMMER.EXE; JDBGMRG.EXE; JEDI.EXE; KAVLITE40ENG.EXE; KAVPERS40ENG.EXE; KAVPF.EXE; KAZZA.EXE; KEENVALUE.EXE; KERIO-PF-213-EN-WIN.EXE; KERIO-WRL-421-EN-WIN.EXE; KERIO-WRP-421-EN-WIN.EXE; KERNEL32.EXE; KILLPROCESSSETUP161.EXE; LAUNCHER.EXE; LDNETMON.EXE; LDPRO.EXE; LDPROMENU.EXE; LDSCAN.EXE; LNETINFO.EXE; LOADER.EXE; LOCALNET.EXE; LOCKDOWN.EXE; LOCKDOWN2000.EXE; LOOKOUT.EXE; LORDPE.EXE; LSETUP.EXE; LUALL.EXE; LUAU.EXE; LUCOMSERVER.EXE; LUINIT.EXE; LUSPT.EXE; MAPISVC32.EXE; MCAGENT.EXE; MCMNHDLR.EXE; MCSHIELD.EXE; MCTOOL.EXE; MCUPDATE.EXE; MCVSRTE.EXE; MCVSSHLD.EXE; MD.EXE; MFIN32.EXE; MFW2EN.EXE; MFWENG3.02D30.EXE; MGAVRTCL.EXE; MGAVRTE.EXE; MGHTML.EXE; MGUI.EXE; MINILOG.EXE; MMOD.EXE; MONITOR.EXE; MOOLIVE.EXE; MOSTAT.EXE; MOUSEBM.EXE; MOUSEMM.EXE; MOUSESYNC.EXE; MPFAGENT.EXE; MPFSERVICE.EXE; MPFTRAY.EXE; MRFLUX.EXE; MSAPP.EXE; MSBB.EXE; MSBLAST.EXE; MSCACHE.EXE; MSCCN32.EXE; MSCMAN.EXE; MSCONFIG.EXE; MSDM.EXE; MSDOS.EXE; MSIEXEC16.EXE; MSINFO32.EXE; MSLAUGH.EXE; MSMGT.EXE; MSMSGRI32.EXE; MSSMMC32.EXE; MSSYS.EXE; MSVXD.EXE; MU0311AD.EXE; MWATCH.EXE; N32SCANW.EXE; NAV.EXE; NAVAP.NAVAPSVC.EXE; NAVAPSVC.EXE; NAVAPW32.EXE; NAVDX.EXE; NAVLU32.EXE; NAVNT.EXE; NAVSTUB.EXE; NAVW32.EXE; NAVWNT.EXE; NC2000.EXE; NCINST4.EXE; NDD32.EXE; NEC.EXE; NEOMONITOR.EXE; NEOWATCHLOG.EXE; NETARMOR.EXE; NETD32.EXE; NETINFO.EXE; NETMON.EXE; NETSCANPRO.EXE; NETSPYHUNTER-1.2.EXE; NETSTAT.EXE; NETUTILS.EXE; NISSERV.EXE; NISUM.EXE; NMAIN.EXE; NOD32.EXE; NORMIST.EXE; NORTON_INTERNET_SECU_3.0_407.EXE; NOTSTART.EXE; NPF40_TW_98_NT_ME_2K.EXE; NPFMESSENGER.EXE; NPROTECT.EXE; NPSCHECK.EXE; NPSSVC.EXE; NSCHED32.EXE; NSSYS32.EXE; NSTASK32.EXE; NSUPDATE.EXE; NT.EXE; NTRTSCAN.EXE; NTVDM.EXE; NTXconfig.EXE; NUI.EXE; NUPGRADE.EXE; NVARCH16.EXE; NVC95.EXE; NVSVC32.EXE; NWINST4.EXE; NWSERVICE.EXE; NWTOOL16.EXE; OLLYDBG.EXE; ONSRVR.EXE; OPTIMIZE.EXE; OSTRONET.EXE; OTFIX.EXE; OUTPOST.EXE; OUTPOSTINSTALL.EXE; OUTPOSTPROINSTALL.EXE; PADMIN.EXE; PANIXK.EXE; PATCH.EXE; PAVCL.EXE; PAVPROXY.EXE; PAVSCHED.EXE; PAVW.EXE; PCFWALLICON.EXE; PCIP10117_0.EXE; PCSCAN.EXE; PDSETUP.EXE; PERISCOPE.EXE; PERSFW.EXE; PERSWF.EXE; PF2.EXE; PFWADMIN.EXE; PGMONITR.EXE; PINGSCAN.EXE; PKGUARD32.EXE; PLATIN.EXE; POP3TRAP.EXE; POPROXY.EXE; POPSCAN.EXE; PORTDETECTIVE.EXE; PORTMONITOR.EXE; POWERSCAN.EXE; PPINUPDT.EXE; PPTBC.EXE; PPVSTOP.EXE; PRIZESURFER.EXE; PRMT.EXE; PRMVR.EXE; PROCDUMP.EXE; PROCESSMONITOR.EXE; PROCEXPLORERV1.0.EXE; PROGRAMAUDITOR.EXE; PROPORT.EXE; PROTECTX.EXE; PSPF.EXE; PURGE.EXE; QCONSOLE.EXE; QSECUE.EXE; QSERVER.EXE; RAPAPP.EXE; RAV7.EXE; RAV7WIN.EXE; RAV8WIN32ENG.EXE; RAY.EXE; RB32.EXE; RCSYNC.EXE; REALMON.EXE; REGED.EXE; REGEDIT.EXE; REGEDT32.EXE; RESCUE.EXE; RESCUE32.EXE; RRGUARD.EXE; RSHELL.EXE; RTVSCAN.EXE; RTVSCN95.EXE; RULAUNCH.EXE; RUN32DLL.EXE; RUNDLL.EXE; RUNDLL16.EXE; RUXDLL32.EXE; SAFEWEB.EXE; SAHAGENT.EXE; SAVE.EXE; SAVENOW.EXE; SBSERV.EXE; SC.EXE; SCAM32.EXE; SCAN32.EXE; SCAN95.EXE; SCANPM.EXE; SCRSCAN.EXE; SETUP_FLOWPROTECTOR_US.EXE; SETUPVAMEEVAL.EXE; SFC.EXE; SGSSFW32.EXE; SH.EXE; SHELLSPYINSTALL.EXE; SHN.EXE; SHOWBEHIND.EXE; SMC.EXE; SMS.EXE; SMSS32.EXE; SOAP.EXE; SOFI.EXE; SPERM.EXE; SPF.EXE; SPHINX.EXE; SPOLER.EXE; SPOOLCV.EXE; SPOOLSV32.EXE; SPYXX.EXE; SREXE.EXE; SRNG.EXE; SS3EDIT.EXE; SSG_4104.EXE; SSGRATE.EXE; SSL.EXE; ST2.EXE; START.EXE; STCLOADER.EXE; STEALTH.DCOM.EXE; STEALTH.DDOS.EXE; STEALTH.EXE; STEALTH.INJECTOR.EXE; STEALTH.STAT.EXE; STEALTH.WM.EXE; SUPFTRL.EXE; SUPPORT.EXE; SUPPORTER5.EXE; SVC.EXE; SVCHOSTC.EXE; SVCHOSTS.EXE; SVSHOST.EXE; SWEEP95.EXE; SWEEPNET.SWEEPSRV.SYS.SWNETSUP.EXE; SYMPROXYSVC.EXE; SYMTRAY.EXE; SYSEDIT.EXE; SYSTEM.EXE; SYSTEM32.EXE; SYSUPD.EXE; TASKKILL.EXE; TASKLIST.EXE; TASKMG.EXE; TASKMGR.EXE; TASKMO.EXE; TASKMON.EXE; TASKSYS.EXE; TAUMON.EXE; TBSCAN.EXE; TC.EXE; TCA.EXE; TCM.EXE; TDS2-NT.EXE; TDS-3.EXE; TEEKIDS.EXE; TFAK.EXE; TFAK5.EXE; TGBOB.EXE; TITANIN.EXE; TITANINXP.EXE; TRACERT.EXE; TRICKLER.EXE; TRJSCAN.EXE; TRJSETUP.EXE; TROJANTRAP3.EXE; TSADBOT.EXE; TVMD.EXE; TVTMD.EXE; TWUNK_65.EXE; UNDOBOOT.EXE; UPDAT.EXE; UPDATE.EXE; UPDATE.PIF; UPGRAD.EXE; USERX.EXE; UTPOST.EXE; VBCMSERV.EXE; VBCONS.EXE; VBUST.EXE; VBWIN9X.EXE; VBWINNTW.EXE; VCSETUP.EXE; VET32.EXE; VET95.EXE; VETTRAY.EXE; VFSETUP.EXE; VIR-HELP.EXE; VIRUSMDPERSONALFIREWALL.EXE; VNLAN300.EXE; VNPC3000.EXE; VPC32.EXE; VPC42.EXE; VPFW30S.EXE; VPTRAY.EXE; VSCAN40.EXE; VSCENU6.02D30.EXE; VSCHED.EXE; VSECOMR.EXE; VSHWIN32.EXE; VSISETUP.EXE; VSMAIN.EXE; VSMON.EXE; VSSTAT.EXE; VSWIN9XE.EXE; VSWINNTSE.EXE; VSWINPERSE.EXE; W32DSM89.EXE; W9X.EXE; WATCHDOG.EXE; WEBDAV.EXE; WEBSCANX.EXE; WEBTRAP.EXE; WFINDV32.EXE; WHOSWATCHINGME.EXE; WIMMUN32.EXE; WIN32.EXE; WIN32US.EXE; WINACTIVE.EXE; WIN-BUGSFIX.EXE; WINDLL2.EXE; WINDOW.EXE; WINDOWS.EXE; WINDRG32.EXE; WINHOST.EXE; WININETD.EXE; WININIT.EXE; WININITX.EXE; WINLOGIN.EXE; WINMAIN.EXE; WINNET.EXE; WINPPR32.EXE; WINRECON.EXE; WINSERVN.EXE; WINSSK32.EXE; WINSTART.EXE; WINSTART001.EXE; WINSYS.EXE; WINTBP.EXE; WINTBPX.EXE; WINTNL.EXE; WINTNPX.EXE; WINTSK32.EXE; WINUPDATE.EXE; WKUFIND.EXE; WNAD.EXE; WNT.EXE; WPA.EXE; WRADMIN.EXE; WRCTRL.EXE; WSBGATE.EXE; WUPDATER.EXE; WUPDT.EXE; WUPNP.EXE; WYVERNWORKSFIREWALL.EXE; XPF202EN.EXE; ZAPRO.EXE; ZAPSETUP3001.EXE; ZATUTOR.EXE; ZONALM2601.EXE; ZONEALARM.EXE Furt de informatii Incearca sa obtina urmatoarele informatii: – Monitorizeaza reteaua folosind un sniffer si cauta urmatoarele siruri de caractere: • :.login; :,login; :!login; :@login; :$login; :%login; :^login; :*login; :-login; :+login; :/login; :\login; :=login; :?login; :'login; :`login; :~login; : login; :.auth; :,auth; :!auth; :@auth; :$auth; :%auth; :^auth; :&auth; :*auth; :-auth; :+auth; :/auth; :\auth; :=auth; :?auth; :'auth; :`auth; :~auth; : auth; :.id; :,id; :!id; :@id; :$id; :%id; :^id; :&id; :*id; :-id; :+id; :\id; :=id; :?id; :'id; :`id; :~id; : id; :.hashin; :!hashin; :$hashin; :%hashin; :.secure; :!secure; :.l; :!l; :$l; :%l; :.x; :!x; :$x; :%x; :.syn; :!syn; :$syn; :%syn – Este pornita o rutina de logare dupa ce viziteaza un site care contine unul din urmatoarele siruri de caractere in URL: • paypal • paypal.com – Face captura la: • Datele introduse de la tastatura • Informatii de logare Alte informatii Mutex: Creeaza urmatorul mutex: • Rx-bawt Special 1.1 Detaliile fisierului Limbaj de programare: Limbaj de programare folosit: C (compilat cu Microsoft Visual C++). Compresia fisierului: Pentru a ingreuna detectia si a reduce marimea fisierului, este folosit un program de compresie runtime.
Descripción insertada por Irina Boldea el martes 11 de abril de 2006 Descripción actualizada por Irina Boldea el martes 11 de abril de 2006
Volver
.
.
.
.