Threat Encyclopedia

W32/Spybot.EO!worm

Analysis

• Virus is 32bit with a compressed file size of 55,199 bytes
  
• If the virus is run, it will move a copy of itself to the undefinedWindowsundefined\System32 folder as "fucker.exe" and modify the registry to auto run at next Windows startup -

  HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Runonce\
  "spolerv.exe" = FUCKER.EXE gtb0t ##tester2## fuckpass (extra data)

  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
  "spolerv.exe" = FUCKER.EXE gtb0t ##tester2## fuckpass (extra data)
  

• If virus is run, it will perform a DNS query against the IRC server "l3mer.hopto.org" in order to identify its known IP address (213.152.251.129)
  

• Next the virus may attempt to connect to the IP address 213.152.251.129 using TCP port 6667
  

• The virus will send the instruction "JOIN ##tester2## fuckpass" and await commands from a hacker or group of hackers
  

• Some of the command supported include the following -

  cd-rom
  cmd
  d0wn
  delete
  disconnect
  execute
  get
  httpserver
  info
  kazaabackupfiles
  keyboardlights
  killprocess
  killthread
  list
  listprocesses
  login
  makedir
  opencmd
  passwords
  quit
  raw
  reboot
  reconnect
  redirect
  redirectspy
  rename
  scan
  sendkeys
  sendto
  server
  shittall
  spy
  startkeylogger
  stopkeylogger
  stopredirectspy
  stopspy
  syn
  threads
  

• The virus may receive an instruction such as the following -

  scan 24.x.x.x 445 3 nb

  This instructs the virus to scan the 24 dot subnet using TCP port 445 (NetBIOS) in search of potential targets
  

• The virus will then attempt to scan IP addresses using TCP port 445 in an effort to detect potential targets for infection - the destination port will begin near 1034 and continue sequentially, with periodic communication on known ports such as 1434 and others
  

• If a system is located, the virus will attempt to connect to that system using weak logon user password combinations
  

• Once a system is compromised, the virus will attempt to copy itself to that system by one of a few possible file names such as kaza.exe, fucker.exe or other file names
  

• The virus will attempt to copy the file to any of the following folders if found -

  Documents and Settings\All Users\Menu DTmarrer\Programmes\Dtmarrage
  Documents and Settings\All Users\Menu Iniciar\Programas\Inicializar
  Documents and Settings\All Users\Menu Avvio\Programmi\Esecuzione automatica
  Documents and Settings\All Users\Menu Start\Programma's\Opstarten
  WINDOWS\All Users\Start Menu\Programs\StartUp
  WINNT\Profiles\All Users\Start Menu\Programs\Startup
  WINDOWS\Start Menu\Programs\Startup
  Documenti e Impostazioni\All Users\Start Menu\Programs\Startup
  Dokumente und Einstellungen\All Users\Start Menu\Programs\Startup
  Documents and Settings\All Users\Start Menu\Programs\Startup
  

• The virus may also send information to the channel broadcasting information about the infected system
  

• The virus will alter settings associated with the peer-to-peer file sharing application Kazaa - the virus will create a subdirectory into the current shared folder for Kazaa named "kazaabackupfiles" and modify the registry to point to this new location -

  HKEY_CURRENT_USER\Software\Kazaa\LocalContent\
  "Dir0" = 012345:undefinedkazaa share pathundefined\kazaabackupfiles\ (extra data)
  

• The virus will write at least one copy of itself to the new location with a file name such as "download_me.exe"
  

• Virus contains the string "SpyBot1.2" in its code
  

Recommended Action

• Block access to the IP address 213.152.251.129
  
• If the ports are not used, block use of TCP ports 445 and 6667 for Internal to External (INT -> EXT) and External to Internal (EXT -> INT) traffic