Alias/esCME-581, Net-Worm.Win32.Mytob.ch [KAV], W32.Zotob.C@mm [NAV], W32/Zotob.C-net, W32/Zotob.C@mm, W32/Zotob.worm [McAfee], WORM_ZOTOB.C [Trend] |
CVECME-581 |
Visible Symptoms
|
Detailed Analysis* This virus writes itself to the System32 folder as "per.exe" and creates a Mutex named "B-O-T-Z-O-R" to prevent loading more than one instance * When this virus is run, it registers to load at Windows startup via the registry - HKCU\Software\Microsoft\Windows\CurrentVersion\Run HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices HKLM\Software\Microsoft\Windows\CurrentVersion\Run HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices * The virus will alter Internet Explorer registry settings - HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess Used to prevent Windows 2000/XP shared access * The virus blocks access attempts to various Antivirus and security vendor sites by modifying the "hosts." domain name resolution file; all modified site names are redirected back to the infected host; copy of modified "hosts" file below - www.symantec.com * This virus contains the following text string but is not displayed - msn: Botzor2 pnp+asn+mail spread. Greetz to good friend
Coder. Based On HellBot3 * This virus binds to TCP port 33333 and can receive common FTP commands such as USER, PASS, SYST, REST, PWD, TYPE, PORT, RETR, QUIT and so on * The virus connects to the IRC server named "diabl0.turkcoders.net" using TCP port 8080 awaiting instructions from a hacker * The virus starts up to 200 processes to search for other computers using TCP port 445 - for each system found, the virus sends PnP exploit code to that system [an attack against pre-MS05-039 systems] * If an attack is successful against the target, the infected system binds with TCP port 8888 and awaits hacker instructions * This virus can spread to other systems using its own SMTP code engine - the virus gathers email addresses from the usual suspects (files that end in these extensions) - '* txt', '* htmb', '* shtl', '* jspl' * The virus avoids using names that have these strings - Abuse, security, admin, support, contact, webmaster,
Info, samples, postmaster, webmaster, noone, nobody,
Nothing, anyone, someone, your, you, me, bugs, Rating,
site, contact, soft, no, somebody, privacy, Service,
help, not, submit, feste, ca, gold-certs, The.bat, page,
Syma, icrosof, msn., hotmail, panda, sopho, borlan,
inpris, Example, mydomai, nodomai, ruslis, gov, gov.,
mil, foo., Unix, math, bsd, mit.e, gnu, fsf., ibm.com,
google, Kernel, linux, fido, usenet, iana, ietf, rfc-ed, * the virus spoofs the "sender" email address and uses any of these names as a sender "From" - "john", "josh", "alex",
"michael", "james", "mike",
"kevin", "david", "george",
"sam", "andrew", "jose", * the virus creates emails with any of the following subject lines - Warning! ! * the virus uses any of these as inserted body text into the new message - Looooool
Photo with one of these extensions - Pif, scr, exe, cmd, bat |
Recommended Action
FortiGate systems: |
