Worm/PoeBot.C.463 - Worm

See also

Summary

Full description

Statistics

Virus:	Worm/PoeBot.C.463
Date discovered:	08/08/2007
Type:	Worm
In the wild:	Yes
Reported Infections:	Low
Distribution Potential:	Medium
Damage Potential:	Medium
Static file:	Yes
File size:	124.436 Bytes
MD5 checksum:	26990003e0aeb5f92fd7a900adbafee0

General Method of propagation:
   • Local network

Aliases:
   • Kaspersky: Backdoor.Win32.PoeBot.c
   • Bitdefender: Backdoor.Agent.YRG

Platforms / OS:
   • Windows 95
   • Windows 98
   • Windows 98 SE
   • Windows NT
   • Windows ME
   • Windows 2000
   • Windows XP
   • Windows 2003

Side effects:
   • Drops a file
   • Records keystrokes
   • Registry modification
   • Makes use of software vulnerability
   • Steals information
   • Third party control

Files It drops a copy of itself using a filename from a list:
– To: %SYSDIR%\ Using one of the following names:
   • csrs.exe
   • logon.exe
   • explorer.exe
   • supoolsvc.exe
   • lsass.exe
   • algs.exe
   • iexplore.exe
   • winamp.exe
   • firewall.exe
   • lssas.exe

It deletes the initially executed copy of itself.

The following file is created:

– A file that is for temporary use and it might be deleted afterwards:
   • C:\%random character string%.bat

Registry The following registry key is added in order to run the process after reboot:

One of the following values is added in order to run the process after reboot:

– [HKLM\Software\Microsoft\Windows\CurrentVersion\Run]
   • "Client Server Runtime Process"="%SYSDIR%\csrs.exe"
   • "Windows Logon Application"="%SYSDIR%\logon.exe"
   • "Windows Explorer"="%SYSDIR%\explorer.exe"
   • "Spooler SubSystem App"="%SYSDIR%\supoolsvc.exe"
   • "Local Security Authority Service"="%SYSDIR%\lsass.exe"
   • "Application Layer Gateway Service"="%SYSDIR%\algs.exe"
   • "Microsoft Internet Explorer"="%SYSDIR%\iexplore.exe"
   • "Winamp Agent"="%SYSDIR%\winamp.exe"
   • "Windows Network Firewall"=%SYSDIR%\firewall.exe
   • "Local Security Authority Service"="%SYSDIR%\lssas.exe"

Network Infection In order to ensure its propagation the malware attemps to connect to other machines as described below.

It drops copies of itself to the following network shares:
   • IPC$
   • C$
   • D$
   • E$
   • C$\Documents and Settings\All Users\Documents\
   • C$\shared
   • C$\windows\system32
   • C$\windows
   • e$\shared
   • d$\shared
   • c$\winnt
   • c$\winnt\system32
   • ADMIN$\system32\
   • ADMIN$
   • print$

It uses the following login information in order to gain access to the remote machine:

– The following list of usernames:
   • staff; teacher; owner; student; intranet; lan; main; office; control;
      siemens; compaq; dell; cisco; ibm; oracle; sql; sa; data; access;
      database; domain; god; backup; technical; mary; katie; kate; george;
      eric; none; guest; chris; ian; neil; lee; brian; susan; sue; sam;
      luke; peter; john; mike; bill; fred; joe; jen; bob; wwwadmin; oemuser;
      user; homeuser; home; internet; www; web; root; server; linux; unix;
      computer; adm; admin; admins; administrat; administrateur;
      administrador; administrator

– The following list of passwords:
   • winpass; blank; xp; nokia; hp; orainstall; sqlpassoainstall; db1234;
      db2; db1; databasepassword; databasepass; dbpassword; dbpass;
      domainpassword; domainpass; hello; hell; love; money; slut; bitch;
      fuck; exchange; loginpass; login; qwe; zxc; asd; qaz; win2000; winnt;
      winxp; win2k; win98; windows; oeminstall; oem; accounting; accounts;
      letmein; sex; outlook; mail; qwerty; temp123; temp; null; default;
      changeme; demo; test; 2005; 2004; 2001; secret; payday; deadline;
      work; 1234567890; 123456789; 12345678; 1234567; 123456; 12345; 1234;
      123; 12; 007; pwd; pass; pass1234; dba; passwd; password; password1;
      abc; ab

Exploit:
It makes use of the following Exploits:
– MS03-026 (Buffer Overrun in RPC Interface)
– MS04-011 (LSASS Vulnerability)
– MS05-039 (Vulnerability in Plug and Play)
–MS06-040 (Vulnerability in Server Service)

IP address generation:
It creates random IP addresses while it keeps the first two octets from its own address. Afterwards it tries to establish a connection with the created addresses.

Infection process:
Creates a TFTP or FTP script on the compromised machine in order to download the malware to the remote location.

Remote execution:
–It attempts to schedule a remote execution of the malware, on the newly infected machine. Therefore it uses the NetScheduleJobAdd function.

IRC To deliver system information and to provide remote control it connects to the following IRC Server:

Server: zt.enterhere**********
Port: 5190
Channel: #usac
Nickname: %eight-digit random character string%

– This malware has the ability to collect and send information such as:
    • Cached passwords
    • CPU speed
    • Current user
    • Details about drivers
    • Free disk space
    • Free memory
    • Malware uptime
    • Information about the network
    • Platform ID
    • Size of memory
    • Username
    • Users' local activity

– Furthermore it has the ability to perform actions such as:
    • Launch DDoS ICMP flood
    • Launch DDoS SYN flood
    • Launch DDoS UDP flood
    • Download file
    • Execute file
    • Join IRC channel
    • Kill process
    • Perform network scan
    • Restart system
    • Send emails
    • Start keylog
    • Updates itself

Stealing It tries to steal the following information:
– Passwords typed into 'password input fields'
– Recorded passwords used by the AutoComplete function
– Email account information obtained from the registry key: HKCU\Software\Microsoft\Internet Account Manager\Accounts

– Passwords from the following programs:
   • FlashFXP
   • MSN Messenger
   • OutlookExpress
   • UnrealIRCD
   • World Of Warcraft
   • Steam
   • Conquer Online
   • Unreal3

– A logging routine is started after keystrokes are typed that match the following string:
   • paypal

– It captures:
    • Keystrokes

– A logging routine is started after a website is visited:
   • paypal.com

– It captures:
    • Keystrokes
    • Login information

Miscellaneous Mutex:

It creates the following Mutex:
• dcf7d2f7071938ba83b50c70eedd5ceb8984

File details Programming language:
The malware program was written in MS Visual C++.

Runtime packer:
In order to aggravate detection and reduce size of the file it is packed with a runtime packer.

See a brief description here.

Description inserted by Monica Ghitun on Wed, 07 Nov 2007 12:11 (GMT+1)
Description updated by Monica Ghitun on Wed, 07 Nov 2007 15:56 (GMT+1)

» About Malware
» About Phishing
» Viruses In the Wild

« back