Nom: Worm/SdBot.bdw La date de la découverte: 19/06/2007 Type: Ver En circulation: Oui Infections signalées Faible Potentiel de distribution: Moyen Potentiel de destruction: Moyen Fichier statique: Oui Taille du fichier: 60.928 Octets Somme de contrôle MD5: 61bd1eca45b4e44fdfc657bbf01bd387 Version VDF: 6.39.00.34 - mardi 19 juin 2007Version IVDF: 6.39.00.34 - mardi 19 juin 2007
Général Méthode de propagation: • Le réseau local Les alias: • Symantec: W32.Randex • Mcafee: W32/Sdbot.worm • Kaspersky: Backdoor.Win32.SdBot.bdw • TrendMicro: Win32/Sdbot!8F5A Plateformes / Systèmes d'exploitation: • Windows 96 • Windows 99 • Windows 98 SE • Windows NT • Windows ME • Windows 2000 • Windows XP • Windows 2003 Effets secondaires: • Il bloque l'accès aux sites web de sécurité • Il crée un fichier malveillant • Il diminue les réglages de sécurité • Il enregistre les frappes de touche • Il modifie des registres • Il vole de l'information • Il facilite l'accès non autorisé à l'ordinateur Fichiers Il s'autocopie dans l'emplacement suivant: • %SYSDIR% \csos.exe – c:\sirh0t_changes_ur_hostfile.bat Les investigations ultérieures ont prouvé que ce ficher est également un Malware. Détecté comme: BAT/Qhost.A Registre Les clés de registre suivantes sont ajoutées afin d'exécuter des processus après le redémarrage: – [HKLM\Software\Microsoft\Windows\CurrentVersion\Run] • csos="csos.exe" – [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] • csos="csos.exe" Les clés de registre suivantes sont ajoutées afin de charger le service après le redémarrage: – [HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices] • csos="csos.exe" Il crée l'entrée suivante afin de passer par le Firewall de Windows XP: – [HKLM\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\ FirewallPolicy\StandardProfile\AuthorizedApplications\List] • %WINDIR% \system32\csos.exe="%WINDIR% \system32\csos.exe:*:Enabled:@xpsp2res.dll,-22019" Infection du réseau Afin de assurer sa propagation, le malware essaye de se connecter à d'autres machines comme décrit ci-dessous. Il s'autocopie dans les partages réseau suivants: • profiles$ • IPC$ • D$ • print$ • E$ • Admin$ • Admin$\system32 • ipc$ Il emploie les informations d'identification suivantes afin de gagner accès à la machine distante: – Une liste de noms d'utilisateurs et de mots de passe: • zxcv; zxc; zulu; zombie; zmodem; zimmerman; zimmerma; ziggy; zeitgeis; zebra; zap; yxcv; youwontguessme; young; yosemite; yolanda; yellowstone; yellowst; yellow; yankee; yang; yaco; xyzzy; xyz; xxxxxxxxx; xxxxxxxx; xxxxxxx; xxxxxx; xxxxx; xxxx; xxx; xx; xray; xp; xmodem; xmen; xman; xfer; xena; wyoming; wwwadmin; www; wwii; WRITE; wormwood; worm; work; worf; wordperf; word; woodwind; wood; women; wombat; woman; wolverin; wolf; wizard; within; wiseass; wisconsin; wisconsi; wired; winxp; winston; winpass; winnt; wing; wine; windozexp; windozeME; windoze98; windoze95; windoze2k; windoze; windowz; WindowsXP; windowsME; windows98; windows95; windows2k; windows; windose; win98; win2k; win2000; win; wilma; willie; williamsburg; williams; william; will; wileecoyote; whore; wholesale; wholesal; whitney; whiting; white; whisky; whatnot; whatever; wh0re; wh0r3; western; west; werewolf; wendy; wendi; well; weenie; weed; wednesda; webpage; web; wave; water; watchwor; wasp; warren; warp; wargames; warfare; warez; ward; waco; w00t; vodka; visualba; visual; visitor; virus; virginia; virgin; village; videogam; video; victor; vicky; vertigo; veronica; venus; vasant; vampire; valerie; vagina; uwontguessme; uucp; utility; util; usmc; userpassword; username; usermane; user1; User; USER; user; usenet; ursula; urchin; uranus; upload; unlock; Unknown; unknown; unix; universi; universe; universa; uniform; unicorn; unhappy; undo; uncle; umesh; ugly; tuttle; turnip; turn; tuesday; tubas; tty; truth; true; tron; trombone; trojan; trivial; trisha; trek; tree; trapdoor; trap; transfer; trails; tracy; tracie; traci; toyota; toxic; tortoise; topography; topograp; tomato; tokenrin; token; toggle; toad; tits; tina; time; tiger; tiffany; thursday; thin; theresa; thailand; text; tetris; testing; testin; tester; test123; Test; test; TEST; tess; terminat; terminal; tera; tennis; temptation; temptati; temp123; temp; TEMP; telnet; telephone; telephon; teenage; teen; technical; tech; tears; teapot; team; teacher; taylor; tarragon; target; tara; tape; tango; tangerine; tangerin; tammy; tamie; tami; tamara; tall; talk; tabasco; SYSTEM; system; sysop; sysadmin; sys; symmetry; sybil; sybase; sword; switch; sweat; swearer; suzie; suzanne; susie; susanne; susan; surfing; surfer; supported; supporte; support; supervis; superuser; superuse; superstage; supersta; superson; superman; super; sunday; sun; summer; sue; sucks; suckmydi; suck; success; subway; subscrib; stuttgart; stuttgar; student1; student; strip; string; streetfi; stratford; stratfor; strangle; strange; stones; stoned; stoneage; steve; stereo; stephanie; stephani; steph; steel; steal; steak; starwars; startup; startrek; start; starship; star; Standard; staff; stacy; stacie; staci; stacey; sr71; squires; sqlpass; sqlagent; sql; spunk; springer; spring; spred; spit; spiderma; spider; spice; spencer; spell; spear; sparrows; spaceshi; spaceman; south; source; sossina; sonya; sonic; sonia; sondra; somebody; software; soft; sodomy; socrates; social; soap; snoopy; snatch; snake; snafu; snach; smut; smtp; smother; smooch; smiles; smile; smart; small; slut; slow; sliders; slick; slave; skull; site; single; singer; simulati; simpsons; simple; simon; simcity; silver; signature; signatur; sierra; siemens; sick; shuttle; short; shivers; shiva; shitpot; shit; shirley; shift; sherri; shell; sheldon; sheffield; sheffiel; sharon; sharks; shark; SHARE; sharc; shannon; sexy; sex; sesame; service; SERVER; serial; serenity; sentry; sentinel; sensor; sega; seed; security; secret; search; scriptkiddie; script; scout; scotty; scott; scorpion; scifi; schoolsucks; school; scheme; scamper; saxon; saturn; saturday; satanik; satanic; satan; sarah; sara; sandy; sandra; sample; samantha; sam; salt; sale; salami; sal; sage; safe; sa; ruth; rush; running; rules; rude; ruby; ruben; rubber; RPC; rough; Ross; roses; rosemary; rosebud; rose; RoscoPColtrane; RoscoP; Rosco; rooted; ROOT; root; ronald; ron; romulan; romeo; romano; rolex; rodent; rockyhor; rocky; rock; rochester; rocheste; rochelle; robyn; robotics; robot; robin; robert; roach; rje; risc; ripple; riot; ring; rightwin; right; riffraff; rick; rich; rhino; reveal; resistan; republic; report; rent; reno; renee; remote; release; regional; referenc; redhead; reddawn; record; rebel; rebecca; rebal; reaper; ream; really; reality; reagan; READ; razor; rascal; rape; random; raleigh; raindrop; rainbow; rain; raid; RAGE; rachmaninoff; rachmani; rachelle; rachel; rabbit; r00t; qwerty; qwert; qwer; qwe; quebec; qaz; pwd; pw123; pw; pussy; puppet; punk; punisher; puneet; pumpkin; puke; puck; public; pub; psychopa; psycho; protozoa; protect; prompt; program; profile; professor; professo; processo; proceed; privs; private; priv; printer; princeton; princeto; prince; presto; prelude; precious; praise; power; poster; post; porsche; porno; porn; pork; poor; poop; pondering; ponderin; polynomial; polynomi; polly; police; poetry; plymouth; pluto; plover; playboy; plane; pizza; piss; pinname; pink; pimp; pierre; pick; phuck; phreak; phrase; phrack; photon; phone; phoenix; philip; phil; peter; pete; pervert; persona; persimmon; persimmo; permit; perfect; percolate; percolat; pepsi; pepper; peoria; pentium; penthous; pentagra; pentagon; penname; penis; Penis; penguin; penelope; pencil; pecker; peanuts; pc; paula; patty; patriot; patrick; patricia; pat; paste; password123; password1; Password; PASSWORD; password; passwd; passphra; pass1234; pass123; pass; pascal; papers; paper; papa; pamela; pam; pakistan; paint; painless; pad; packer; packard; pacific; oxford; Owner; OWNER; owner; owned; own; owa; outside; output; outlook; outlaw; outdoors; osiris; oscar; orwell; orient; orca; orange; oracle; operator; opensesa; openlock; opening; omega; olivia; olivetti; oldage; okay; office; oemuser; oeminstall; OEM; oem; ocelot; oceanography; oceanogr; obscurit; nyquist; nuts; nutrition; nutritio; number; null; nukem; nuke; nude; nuclear; noxious; november; novel; nova; noth; notes; noreen; noob; none; nokia; node; nobody; noble; nnaacp; nita; nintendo; Nilez; nightmar; night; nicotine; nicole; nice; next; newyork; newton; newsgrou; news; newborn; new; network; netscape; netfuck; netdevil; netbios; net-devil; net; ness; neptune; nepenthe; neil; ND; navy; nasa; napoleon; nancy; name; nagel; mypc123; mypc; mypass123; mypass; mutant; muppets; msdos; MS; mpeg; MP; mozart; movies; movie; move; mouse; mountain; mosaic; mortgage; mortalco; mortal; morris; morley; more; moose; moor; moom; monica; monday; moguls; mogul; modem; mkii; mit; mission; misfit; minsky; minimum; mine; mike; midieval; microsof; micropro; microchi; micro; mickey; michelle; michele; michelan; michel; michael; mice; mgr; mets; metalica; metalhea; metal; merlin; mercury; menu; menace; memory; member; melrose; mellon; melissa; megan; megadeth; megabyte; meagan; maurice; Matthew; Matt; math; Mat; master; mass; mason; mary; marvin; marty; mars; marriage; marni; markus; mark; marines; marijuan; marietta; mariens; maria; marcy; marci; mara; manager; mana; malcom; malcolm; maint; main; mail; magnet; magic; maggot; macro; mack; macintosh; macintos; machine; M$; lynne; lynn; lust; luke; lude; lucy; lucus; luck; lover; lovebug; love; louis; loser; lorraine; lorin; lori; lore; loose; lolopc; lol; lois; logout; loginwor; loginpass; Login; login; logic; lockword; lockout; lock; LOCAL; load; liz; live; literatu; lisp; lisa; lips; lion; linux; link; linda; limited; limbaugh; lima; lightsab; light; life; licker; lick; library; liberal; lexluthe; lewis; letmein; leslie; lesbian; leroy; leland; legal; leftwing; left; leet; lee; lebesgue; leah; lazer; lazarus; lava; laura; laser; larry; larkin; lara; laptop; lana; lan; lamination; laminati; lambda; lakers; ladle; ladies; l33t; l337; kristy; kristine; kristin; kristie; kristi; kristen; krista; known; knightma; knight; knife; klingon; kitten; kissmyas; kiss; kirkland; kirk; king; kimberly; kim; kilo; killthem; killer; kill; kids; kiddie; keyword; keyin; keybord; key; kewl; kevin; kerry; kerrie; kerri; kernel; kermit; keri; kelly; katrina; katina; katie; kathy; kathrine; kathleen; kate; katana; karina; karie; karen; kaka; jupiter; june; juliet; julie; julia; juicy; juggle; judy; judith; joyce; joy; journal; joshua; joseph; johnny; johndoe; john; joe; jody; joanne; joan; jixian; jill; jewelry; jester; jessica; jerusale; jerry; jenny; jennifer; jenni; jen; jeff; jeanne; jean; jazz; java; jasmin; japan; janie; janice; janet; jane; jail; jackie; isis; irule; irishman; irene; Inviter; invent; intranet; internet; Internet; integer; inside; input; innocuous; innocuou; inna; ingrid; ingress; ingres; indians; indiana; indian; india; include; imperial; immortal; imbroglio; imbrogli; image; illumina; ihavenopass; icecream; ibm; ian; hypertxt; hyper; hydrogen; hutchins; hunter; hunt; http; hq; hotel; hotdog; host; horus; horse; horror; horrible; horny; hooters; hooker; honey; homework; homeuser; homer; homepage; home; hollywoo; holly; hole; ho; hits; hitler; highland; high; hidden; hibernia; hiawatha; hexadeci; hewlett; heroin; hero; herbert; herb; help; hello; hell; heinlein; heidi; hebrides; heaven; heather; heathen; heat; headoffice; headbang; head; haxing; hax0r; hax; hawaii; haven; hate; harvey; harold; harmony; harddriv; hardcore; hard; happening; happenin; handjob; handily; handel; hamster; hamlet; hallowee; hal; hair; hagar; hacker; hacked; hack; h4x1ng; h4x0ring; h4x0r1ng; guntis; gumption; guitar; Guest; GUEST; guest; guessme; guess; gucci; guardian; gryphon; group; green; great; grant; grand; grahm; graham; grades; govermen; gouge; gosling; gorges; gorgeous; good; golfer; golf; golden; gold; godblessyou; god; gobo; gnu; glen; glacier; girl; ginger; gina; gigabyte; gibson; ghost; gertrude; germ; george; gauss; gatt; gatherin; gateway; Gast; garfield; gardner; games; gabriel; fungible; function; fun; FULL; fudge; fuckyou; fuckme; fucking; fucker; fucked; fuck; fubar; fryguy; frog; frighten; friends; friend; friday; french; freedom; free; freddy; fred; freak; frank; france; foxtrot; fourier; forsythe; fornicat; format; form; forever; foresight; foresigh; ford; force; football; foolproof; foolproo; fool; food; foobar; flowers; flower; florida; float; flakes; fishers; fish; firewall; fire; finite; FILES; file; fight; field; fidelity; ferrari; fermat; fender; felicia; feds; fear; fast; fart; faraday; farad; family; false; falcon; faith; fairway; extension; extensio; explosiv; explorer; explore; explode; expert; exchnge; exchange; evelyn; euclid; eternity; estate; establish; establis; ersatz; erotic; erin; erika; erica; eric; erenity; enzyme; enterprise; enterpri; enter; english; england; engineer; engine; enemy; enable; emmanuel; emily; emerald; email; ellen; elizabeth; elizabet; elephant; electron; elanor; elaine; einstein; einsiein; eileen; eiderdown; eiderdow; egghead; edwina; edwin; education; educatio; edu; edition; edit; edinburgh; edinburg; edges; eddie; echo; eatme; easy; easier; earth; eagle; eager; dyke; dungeon; duncan; dulce; duke; duelist; dudette; dude; dud3; duck; drought; drive; drdoom; dragon; dos; dope; doors; door; doonesbu; doomsday; doomii; doom2; doom; dong; donaldduck; domainpassword; domainpass; domain; dollar; dog; doctor; display; disney; diskette; disk; discovery; discover; disclose; discipli; disc; dirty; director; direct; dipshit; dinosaur; digital; dieter; diet; diehard; dick; dice; diane; diana; diamond; dial; devil; device; develop; desperate; desperat; desktop; desk; desiree; dennis; denise; democrat; demo; DEMO; deluge; delta; Dell; dell; defoe; Default; DEFAULT; default; deck; december; debug; deborah; debbie; deb; deathsta; death; dead; dbpassword; dbpass; db1234; db1; dawn; dave; databasepassword; databasepass; database; data; darkaven; dark; dapper; danny; danielle; daniel; dancer; dana; daisy; daemon; d00d; cynthia; cyberspa; cyberpun; cyber; customer; cunt; ctx; cshrc; crystal; cristina; criminal; crime; cretin; creosote; credit; creature; creation; create; cream; crash; crackpot; crack; cowboy; couscous; country; counters; correct; cornelius; corneliu; copy; cops; copper; cooper; cool; cookie; cookbook; cook; control; continue; console; conserva; connie; connect; condom; condo; comrades; comrade; computin; computer; compaq; company; commrades; commrade; commit; comics; combat; color; collins; cold; cola; coke; coin; coffee; codeword; codename; code; cock; cocainco; cocacola; coast; clusters; cluster; clinton; cleavage; claymore; claudia; classic; classes; class; cisco; cindy; cigarett; cigar; CHT; christy; christine; christina; christin; chris; chip; chester; chess; chemistry; chemistr; chem; CHECK; chat; charon; charming; charlie; charles; charity; Changeme; changeme; change; cerulean; celtics; celtic; celt; cecily; cayuga; cave; cathy; catholic; catherine; catherin; cat; castle; cash; cascades; carson; carrie; caroline; carolina; carole; carol; carmen; carla; caren; cardinal; card; capture; captain; capitol; cantor; candy; candi; camping; campanile; campanil; camille; californ; cad; butthead; butt; butch; burn; burgess; bung; bumbling; bullshit; bulls; bsd; brutefor; brute; brunette; bruce; brothel; broadway; bridget; brian; brenda; breast; break; bravo; brandy; brandi; bradley; boyscout; BOTH; born; book; boobs; boob; boner; bomb; bob; board; blues; blue; blowjob; blow; bloodaxe; blood; blondie; blonde; blank; black; bla; bitnet; bitmap; bitch; bishop; bird; bios; binary; billy; bill; bigfoot; bicameral; bicamera; bible; beverly; betty; betsie; beth; beta; beryl; berliner; berlin; berkeley; beowulf; benz; beloved; bell; behead; begin; beethoven; beethove; becky; beaver; beauty; beater; beast; bear; beammeup; beach; batman; batch; bassoon; bass; basic; baseball; bartman; bart; baritone; barf; bare; barber; barbara; banks; bank; bandit; bananas; banana; ball; bailey; badass; backup; BACKUP; backdoor; bacchus; baby; babe; azure; aztecs; authoriz; attack; atom; atmosphere; atmosphe; athena; asshole; asm; asian; asdfgh; asdf; asd; artist; arthur; arrow; army; arlene; ariadne; aria; april; apollo13; anything; anvils; anthropogenic; anthropo; anthrax; answer; anonymou; anon; annette; anne; anna; ann; anita; animals; animal; angie; angerine; angela; anfo; andy; andromache; andromac; android; andrea; anchor; anarchy; anarchis; analog; anal; amy; amorphous; amorphou; america; amber; amanda; amadeus; ama; alphabet; alpha; allow; allison; alison; alisa; alicia; alice; aliases; algebra; alf; Alexander; alexande; Alex; alex; alert; albert; albatross; albatros; albany; alaska; Al3x; airplane; aids; afro; aerobics; adult; adrianna; adrian; Administrator; ADMINISTRATOR; administrator; Administrateur; Administrador; EdmInistreiter; L'amministratore; oikeusministeri; forsterkning; administrada; administrat; admin123; Admin; ADMIN; admin; adm; adam; ada; accounts; accounting; account; access; ACCESS; accept; academic; academia; abcd; abc123; abc; aaa; 88888888; 654321; 54321; 2600; 2003; 2002; 123qwe; 123asd; 123abc; 1234qwer; 123467890; 12346789; 1234678; 123467; 12346; 123456789; 12345678; 1234567; 123456; 12345; 1234; 123123; 123; 121212; 121; 12; 11111111; 111111; 111; 110; 0wned; 0wn3d; 007; 00000000; 000000; 00000; 0000; 000; 00; !@; $%^&*; !@; $%^&; !@; $%^; !@; $%; !@; $ La création des adresses IP: Il crée des adresses IP aléatoires tandis qu'il garde le premier octet de son propre adresse. Ensuite il essaye d'établir une connexion avec les adresses créées. Exécution à distance: –Il essaye de programmer une exécution à distance du malware, sur la machine nouvellement infectée. Par conséquent il emploie la fonction NetScheduleJobAdd. IRC Afin de fournir des informations sur le système et un accès à distance, il se connecte au serveur IRC suivant: Serveur: csos.********** Port: 4961 Le mot de passe du serveur: 146751dhzx Canal: #100+ Pseudonyme: %chaîne de caractères aléatoire% Mot de passe: hzx – Ce Malware a la capacité de ramasser et d'envoyer des informations tel que: • Vitesse du CPU • Utilisateur courant • Espace libre sur le disque dur • Mémoire libre • Le temps de fonctionnement du Malware • Information sur le réseau • Information sur des processus courants • Taille de mémoire • Nom d'utilisateur • Information sur le système d'exploitation Windows – Ensuite il a la capacité d'opérer des actions tel que: • Lancer des attaques DDoS SYN • Télécharger un fichier • Éditer le registre • Finir le processus • Commence le keylog • Se mettre à jour tout seul Hôtes Le fichier hôte est modifié, comme il est expliqué: – L'accès aux liens URL suivants est effectivement bloqué : • www.symantec.com; securityresponse.symantec.com; symantec.com; pandasoftware.com; www.pandasoftware.com; www.sophos.com; sophos.com; www.mcafee.com; mcafee.com; downloads-us1.kaspersky-labs.com; updates1.kaspersky-labs.com; updates2.kaspersky-labs.com; updates3.kaspersky-labs.com; downloads1.kaspersky-labs.com; downloads2.kaspersky-labs.com; downloads3.kaspersky-labs.com; ftp.downloads1.kaspersky-labs.com; ftp.downloads2.kaspersky-labs.com; ftp.downloads3.kaspersky-labs.com; dnl-eu5.kaspersky-labs.com; liveupdate.symantecliveupdate.com; www.viruslist.com; viruslist.com; f-secure.com; www.f-secure.com; kaspersky.com; kaspersky-labs.com; www.avp.com; www.kaspersky.com; avp.com; www.networkassociates.com; networkassociates.com; www.ca.com; ca.com; mast.mcafee.com; my-etrust.com; www.my-etrust.com; download.mcafee.com; dispatch.mcafee.com; secure.nai.com; nai.com; www.nai.com; update.symantec.com; updates.symantec.com; us.mcafee.com; liveupdate.symantec.com; customer.symantec.com; rads.mcafee.com; trendmicro.com; www.trendmicro.com; www.grisoft.com; virustotal.com; www.virustotal.com; windowsupdate.microsoft.com; www.microsoft.com; microsoft.com; virusscan.jotti.org Porte dérobée Le port suivant est ouvert: – %SYSDIR% \csos.exe sur le port TCP 113 En conséquence la possibilité de contrôle à distance est fournie. Informations divers Mutex: Il crée les Mutex suivants: • MUTEX_ID_01000001 • csos Détails de fichier Langage de programmation: Le fichier a été écrit en MS Visual C++. Logiciel de compression des fichiers exécutables: Afin d'entraver la détection et de réduire la taille du fichier il est compressé avec un logiciel de compression des exécutables.
Description insérée par Alexandru Dinu le mercredi 3 octobre 2007 Description mise à jour par Andrei Gherman le jeudi 4 octobre 2007
Retour
.
.
.
.