Home / malware

PDF

Backdoor.Bot.109216

First posted on 21 November 2011.
Source: BitDefender

Aliases :

Backdoor.Bot.109216 is also known as Net-Worm.Win32.Kolabc.hki:, KAV W32.Spybot.Worm:, Symantec Win32/Hatob.E, worm Win32/Hatob.E, worm:, NOD32.

Explanation :

This is a piece of malware that has worm, downloader, backdoor, keylogger and spy ability. It may arrive on a system after being exploited by a copy of the worm, residing on an infected machine in the network. After execution, the malware will inject a pice of code in kernel mode (by gaining acces to DevicePhysicalMemory). It will make a copy of itself inside c:windowsfontsunwise_.exe (hidden), execute it and continue execution there. The original file it will then be deleted. The worm will register itself as a service unde the name: Windows Hosts Controller, and setting the information to "Enables Windows Host Controller Service. This service cannot be stopped." discouraging users from deleting it.
The following modifications will be made to the registry:
HKLMSYSTEMControlSet001ServicesSharedAccessParametersFirewallPolicyStandardProfileEnableFirewall = 0 (disables the firewall)
HKLMSYSTEMCurrentControlSetServicesSharedAccessParametersFirewallPolicyDomainProfileAuthorizedApplicationsListunwise_.exe = unwise_.exe:*:enabled:system
HKLMSOFTWAREMicrosoftSecurity CenterAntiVirusDisableNotify = 1 (disables antivirus notifications)
HKLMSOFTWAREPoliciesMicrosoftMRTDontReportInfectionInformation = 1 (disables infection-reports)
HKLMSOFTWAREPoliciesMicrosoftWindowsWindowsUpdateDoNotAllowXPSP2 = 1 (disables Windows Update)
HKLMSoftwareMicrosoftOLEEnableDCOM = N (disables DCOM functionality)
HKLMSYSTEMCurrentControlSetControlLsa
estrictanonymous = 1
HKLMSYSTEMCurrentControlSetServicesTcpipParametersMaxUserPort = fffe (sets the maximum port value an application can request)
HKLMSYSTEMCurrentControlSetServicesAfdParametersDisableRawSecurity = 1 (enables non-admin privileged application to create raw-sockets)
HKLMSoftwarePoliciesMicrosoftWindows NTWindows File ProtectionSFCDisable = 4294967197 (disbales file protection, enabling remote attackers to view/modify any file he wants)
HKLMSoftwareMicrosoftWindowsCurrentVersionInternet SettingsMaxConnectionsPer1_0Server = fffe

- The worm has the ability to spread via:
o USB drives; when it detects a new drive, it will make a fresh copy of itself, on the USB drive in the following directory:
RecyclerS-x-x-xx-xxxxxxxxxx-xxxxxxxxxx-xxxxxxxxx-xxxxfile-name.exe. It will also create an autorun.inf file that will point to the new copy.

o Network shares (SMB - the worm attacks PC NETWORK PROGRAM 1.0, LANMAN1.0, Windows for Workgroups 3.1a, LM1.2X002, LANMAN2.1, NT LM 0.12, especially, to replicate); when it finds a new share, it enables a dictionary-attack, using very common passwords, like 1234, qwerty, password, etc. As soon as it gains acces, it will create a copy of itself, and a desktop.ini file, where it will, among others:
icon=%SystemRoot%system32SHELL32.dll,4
which will make the worms executable look like the Recycle Bin icon; opening the "recycle bin" will run the worm.

o Exploit
The worm uses the following exploits to replicate across the network: MS03-039, MS06-040, MS08-067.

- Keylogger capabilities
The worm has keylogger capabilities; it logs every key pressed on the keyboard.

- Self - protection
Besides the fact that it is packed, the worm has the ability to detect some virtual-environments like VMWare, SandBoxie, or some tools usually used for reverse engineering/malware analysis like Honey, Snort, HoneyMule, etc. When it detects any of these, it will simply quit.

- Downloader capabilities
The worm also has the capabilitie to download other executables from the internet; also, it perioadically updates itself, by downloading new copies.
Some of the hosts the worm communicates with are:
[removed]10man.weedns.com:3305
[removed]010413.whyI.org:3305
[removed]noman.weedns.com:3305
[removed]0x20.biz:3305
[removed]10x1.co.cc:3305
[removed]mmgr.co.cc:3305
[removed]lephone.dd.blueline.be:3305
[removed]onewire.dd.blueline.be:3305
[removed]onelogin.dd.blueline.be:3305
[removed]ospace.etowns.net:3305
[removed]eforums.bbsindex.com:3305
[removed]10man.weedns.com:3308
[removed]010413.whyI.org:3308
[removed]noman.weedns.com:3308
[removed]0x20.biz:3308
[removed]10x1.co.cc:3308
[removed]mmgr.co.cc:3308
[removed]lephone.dd.blueline.be:3308
[removed]onewire.dd.blueline.be:3308
[removed]onelogin.dd.blueline.be:3308
[removed]ospace.etowns.net:3308
[removed]eforums.bbsindex.com:3308

- Spy ability
It can steal e-mail accounts (registry key: SoftwareMicrosoftInternet Account ManagerAccounts), it cand act as a sniffer (by creating a raw socket which intercepts all the packets enter/leave the specified interface), it has port scanner and it retreivesd data about the computer, like the CPU, installed RAM, Operating System, System directory, Computer name, current user, date, time, uptime, free space on hard-disks, internet bandwidth, number of USBs infected, etc.

- Backdoor
Finally, the worm has the backdoor ability; this enables a remote attacker to connect to an infected computer and running various command on it (the worm may connect to an IRC channel before). Some of the tasks a remote attacker can do on the infected machine are: run cmd, kill/create processes, view e-mails, view pressed keys, create/remove directories, download/upload files, do a port scan, retreive the public ip, sniff network packets. These are corelated with the other capabilities of the malware (keylogger, spy, etc.)

Last update 21 November 2011

 

TOP