BackDoor.IRC.Bot.733

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Intel Display Manager' = '<SYSTEM32>\igfxdmv86.exe'

Creates the following files on removable media:

<Drive name for removable media>:\Autorun.inf
<Drive name for removable media>:\~Drivers\ZcApVlZivmAv.exe

Malicious functions:

To bypass firewall, removes or modifies the following registry keys:

[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] '<SYSTEM32>\igfxdmv86.exe' = '<SYSTEM32>\igfxdmv86.exe:*:Enabled:VLAN'
[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '<SYSTEM32>\igfxdmv86.exe' = '<SYSTEM32>\igfxdmv86.exe:*:Enabled:VLAN'

Creates and executes the following:

<SYSTEM32>\igfxdmv86.exe <Full path to virus>

Executes the following:

<SYSTEM32>\sc.exe delete SmcService
<SYSTEM32>\sc.exe stop "Symantec AntiVirus"
<SYSTEM32>\net.exe stop "Symantec AntiVirus"
<SYSTEM32>\net1.exe stop SmcService
<SYSTEM32>\net.exe stop SmcService
<SYSTEM32>\sc.exe stop SmcService
<SYSTEM32>\sc.exe config SmcService start= disabled
<SYSTEM32>\sc.exe config "Symantec AntiVirus" start= disabled
<SYSTEM32>\sc.exe config "Norton Antivirus Server" start= disabled
<SYSTEM32>\net1.exe stop "Norton Antivirus Server"
<SYSTEM32>\sc.exe delete "Norton Antivirus Server"
<SYSTEM32>\sc.exe stop "Norton Antivirus Server"
<SYSTEM32>\net1.exe stop "Symantec AntiVirus"
<SYSTEM32>\sc.exe delete "Symantec AntiVirus
<SYSTEM32>\net.exe stop "Norton Antivirus Server"
<SYSTEM32>\net1.exe stop OutpostFirewall
<SYSTEM32>\net.exe stop TmPfw
<SYSTEM32>\sc.exe stop TmPfw
<SYSTEM32>\sc.exe delete OutpostFirewall
<SYSTEM32>\net.exe stop OutpostFirewall
<SYSTEM32>\sc.exe stop OutpostFirewall
<SYSTEM32>\sc.exe config OutpostFirewall start= disabled
<SYSTEM32>\sc.exe config TmPfw start= disabled
<SYSTEM32>\sc.exe config KPF4 start= disabled
<SYSTEM32>\sc.exe delete KPF4
<SYSTEM32>\net1.exe stop KPF4
<SYSTEM32>\sc.exe stop KPF4
<SYSTEM32>\sc.exe delete TmPfw
<SYSTEM32>\net1.exe stop TmPfw
<SYSTEM32>\net.exe stop KPF4
<SYSTEM32>\sc.exe delete SPF4
<SYSTEM32>\net.exe stop acssrv
<SYSTEM32>\sc.exe stop acssrv
<SYSTEM32>\net1.exe stop SPF4
<SYSTEM32>\net.exe stop SPF4
<SYSTEM32>\sc.exe stop SPF4
<SYSTEM32>\sc.exe config SPF4 start= disabled
<SYSTEM32>\sc.exe config acssrv start= disabled
<SYSTEM32>\sc.exe config SavService start= disabled
<SYSTEM32>\net1.exe stop SAVService
<SYSTEM32>\sc.exe delete SAVService
<SYSTEM32>\sc.exe stop SAVService
<SYSTEM32>\net1.exe stop acssrv
<SYSTEM32>\sc.exe delete acssrv
<SYSTEM32>\net.exe stop SAVService
<SYSTEM32>\sc.exe delete cmdAgent
<SYSTEM32>\net.exe stop vsmon
<SYSTEM32>\sc.exe stop vsmon
<SYSTEM32>\net1.exe stop cmdAgent
<SYSTEM32>\net.exe stop cmdAgent
<SYSTEM32>\sc.exe stop cmdAgent
<SYSTEM32>\sc.exe config cmdAgent start= disabled
<SYSTEM32>\sc.exe config vsmon start= disabled
<SYSTEM32>\sc.exe config SbPF.Launcher start= disabled
<SYSTEM32>\net1.exe stop SbPF.Launcher
<SYSTEM32>\sc.exe delete SbPF.Launcher
<SYSTEM32>\sc.exe stop SbPF.Launcher
<SYSTEM32>\net1.exe stop vsmon
<SYSTEM32>\sc.exe delete vsmon
<SYSTEM32>\net.exe stop SbPF.Launcher
<SYSTEM32>\sc.exe delete "avast! Antivirus"
<SYSTEM32>\net.exe stop AntiVirService
<SYSTEM32>\sc.exe stop AntiVirService
<SYSTEM32>\net1.exe stop "avast! Antivirus"
<SYSTEM32>\net.exe stop "avast! Antivirus"
<SYSTEM32>\sc.exe stop "avast! Antivirus"
<SYSTEM32>\sc.exe config "avast! Antivirus" start= disabled
<SYSTEM32>\sc.exe config AntiVirService start= disabled
<SYSTEM32>\sc.exe config PASRV start= disabled
<SYSTEM32>\sc.exe delete PASRV
<SYSTEM32>\net1.exe stop PASRV
<SYSTEM32>\sc.exe stop PASRV
<SYSTEM32>\net1.exe stop AntiVirService
<SYSTEM32>\sc.exe delete AntiVirService
<SYSTEM32>\net.exe stop PASRV
<SYSTEM32>\sc.exe delete CSIScanner
<SYSTEM32>\net.exe stop K7RTScan
<SYSTEM32>\sc.exe stop K7RTScan
<SYSTEM32>\net1.exe stop CSIScanner
<SYSTEM32>\net.exe stop CSIScanner
<SYSTEM32>\sc.exe stop CSIScanner
<SYSTEM32>\sc.exe config CSIScanner start= disabled
<SYSTEM32>\sc.exe config K7RTScan start= disabled
<SYSTEM32>\sc.exe config K7TSMngr start= disabled
<SYSTEM32>\net1.exe stop K7TSMngr
<SYSTEM32>\sc.exe delete K7TSMngr
<SYSTEM32>\sc.exe stop K7TSMngr
<SYSTEM32>\net1.exe stop K7RTScan
<SYSTEM32>\sc.exe delete K7RTScan
<SYSTEM32>\net.exe stop K7TSMngr
<SYSTEM32>\net1.exe stop NOD32krn
<SYSTEM32>\net.exe stop ekrn
<SYSTEM32>\sc.exe stop ekrn
<SYSTEM32>\sc.exe delete NOD32krn
<SYSTEM32>\net.exe stop NOD32krn
<SYSTEM32>\sc.exe stop NOD32krn
<SYSTEM32>\sc.exe config NOD32krn start= disabled
<SYSTEM32>\sc.exe config ekrn start= disabled
<SYSTEM32>\sc.exe config McShield start= disabled
<SYSTEM32>\sc.exe delete McShield
<SYSTEM32>\net1.exe stop McShield
<SYSTEM32>\sc.exe stop McShield
<SYSTEM32>\sc.exe delete ekrn
<SYSTEM32>\net1.exe stop ekrn
<SYSTEM32>\net.exe stop McShield
<SYSTEM32>\net1.exe stop VSSERV
<SYSTEM32>\net.exe stop avg8wd
<SYSTEM32>\sc.exe stop avg8wd
<SYSTEM32>\sc.exe delete VSSERV
<SYSTEM32>\net.exe stop VSSERV
<SYSTEM32>\sc.exe stop VSSERV
<SYSTEM32>\sc.exe config VSSERV start= disabled
<SYSTEM32>\sc.exe config avg8wd start= disabled
<SYSTEM32>\sc.exe config avg9wd start= disabled
<SYSTEM32>\sc.exe delete avg9wd
<SYSTEM32>\net1.exe stop avg9wd
<SYSTEM32>\sc.exe stop avg9wd
<SYSTEM32>\sc.exe delete avg8wd
<SYSTEM32>\net1.exe stop avg8wd
<SYSTEM32>\net.exe stop avg9wd

Injects code into

the following system processes:

%WINDIR%\Explorer.EXE

Searches for windows to

detect analytical utilities:

ClassName: 'PROCMON_WINDOW_CLASS' WindowName: ''
ClassName: '' WindowName: 'Process Monitor - Sysinternals: www.sysinternals.com'
ClassName: 'PROCMON_WINDOW_CLASS' WindowName: 'Process Monitor - Sysinternals: www.sysinternals.com'
ClassName: 'OLLYDBG' WindowName: ''
ClassName: 'TIdaWindow' WindowName: ''
ClassName: 'FileMonClass' WindowName: ''

detect programs and games:

ClassName: 'gdkWindowToplevel' WindowName: 'The Wireshark Network Analyzer'

Hides the following processes:

<Full path to virus>
<SYSTEM32>\igfxdmv86.exe

Modifies file system :

Creates the following files:

%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ex1[1].exe
C:\cwsandbox\cwsandbox.exe
<SYSTEM32>\igfxdmv86.exe

Sets the 'hidden' attribute to the following files:

<SYSTEM32>\igfxdmv86.exe

Deletes itself.

Network activity:

Connects to:

's1#.##babycani.su':6303
's4.###abycani.su':35920
's2#.##babycani.su':48912
's1#.#etsplay.su':4502
'1.###splay.su':80

TCP:

HTTP GET requests:

1.###splay.su/net/ex1.exe

UDP:

DNS ASK s1#.##babycani.su
DNS ASK s4.###abycani.su
DNS ASK s2#.##babycani.su
DNS ASK s1#.#etsplay.su
DNS ASK 1.###splay.su

Miscellaneous:

Searches for the following windows:

ClassName: '' WindowName: ' Import REConstructor V1.6 Final MackT/uCF -- >> UnREal-RCE << --'
ClassName: '' WindowName: 'CHimpREC - ReCon Edition - (C) 2008 TiGa'
ClassName: '' WindowName: 'RE-Pair 0.6: IDP '
ClassName: '' WindowName: 'RL!dePacker - Generic Unpacker'
ClassName: '' WindowName: 'Import REConstructor v1.6 FINAL (C) 2001-2003 MackT/uCF'
ClassName: '' WindowName: 'Import REConstructor v1.6.1 FIXED FINAL (C) 2001-2003 MackT/uCF / 2006'
ClassName: '' WindowName: 'RE-Pair 0.6: IDP not '
ClassName: 'TCPViewClass' WindowName: ''
ClassName: '#32770' WindowName: 'Regshot 1.8.2'
ClassName: 'PROCEXPL' WindowName: ''
ClassName: 'CNetmonMainFrame' WindowName: 'Microsoft Network Monitor 3.3'
ClassName: 'SmartSniff' WindowName: 'SmartSniff'
ClassName: 'CurrPorts' WindowName: 'CurrPorts'
ClassName: 'WinDbgFrameClass' WindowName: ''
ClassName: 'IdaView' WindowName: ''
ClassName: '18467-41' WindowName: ''
ClassName: 'WispWindowClass' WindowName: ''
ClassName: 'ID' WindowName: ''
ClassName: 'MYDEBUG' WindowName: ''
ClassName: 'API_TRACE_MAIN' WindowName: ''
ClassName: '' WindowName: 'QuickUnpack 2.2'
ClassName: '' WindowName: 'CDW'
ClassName: '' WindowName: '[PeCompact 2.x Unpacker]'
ClassName: '' WindowName: 'Rock Debugger - [Disassembly]'
ClassName: '' WindowName: 'POISON?B?? - [Professional Edition]'
ClassName: '' WindowName: 'PhantOm - [Professional Edition]'

Technologies

Begriffe

Schulung und Training

Mythen

Technical Information

Curing recommendations

Free trial