BackDoor.IRC.Bot.364

Added to the Dr.Web virus database: 2012-02-01

Virus description added: 2012-02-22

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\conime.exe] 'Debugger' = 'MsRfClient.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'conime.exe' = 'conime.exe'

Creates the following files on removable media:

<Drive name for removable media>:\Autorun.inf
<Drive name for removable media>:\~data\832590.exe

Malicious functions:

To bypass firewall, removes or modifies the following registry keys:

[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] '<SYSTEM32>\MsRfClient.exe' = '<SYSTEM32>\MsRfClient.exe:*:Enabled:LAN Router'
[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '<SYSTEM32>\MsRfClient.exe' = '<SYSTEM32>\MsRfClient.exe:*:Enabled:LAN Router'

Creates and executes the following:

<SYSTEM32>\MsRfClient.exe <Full path to virus>

Executes the following:

<SYSTEM32>\sc.exe delete "avast! Antivirus"
<SYSTEM32>\sc.exe config "avast! Antivirus" start= disabled
<SYSTEM32>\net.exe stop AntiVirService
<SYSTEM32>\net1.exe stop "avast! Antivirus"
<SYSTEM32>\sc.exe delete K7TSMngr
<SYSTEM32>\net1.exe stop K7TSMngr
<SYSTEM32>\sc.exe stop "avast! Antivirus"
<SYSTEM32>\net.exe stop "avast! Antivirus"
<SYSTEM32>\sc.exe stop AntiVirService
<SYSTEM32>\net.exe stop PASRV
<SYSTEM32>\sc.exe config PASRV start= disabled
<SYSTEM32>\net1.exe stop PASRV
<SYSTEM32>\sc.exe delete PASRV
<SYSTEM32>\net1.exe stop AntiVirService
<SYSTEM32>\sc.exe config AntiVirService start= disabled
<SYSTEM32>\sc.exe stop PASRV
<SYSTEM32>\sc.exe delete AntiVirService
<SYSTEM32>\sc.exe config K7TSMngr start= disabled
<SYSTEM32>\net.exe stop MsMpSvc
<SYSTEM32>\sc.exe delete CSIScanner
<SYSTEM32>\sc.exe config MsMpSvc start= disabled
<SYSTEM32>\sc.exe stop MsMpSvc
<SYSTEM32>\sc.exe stop CSIScanner
<SYSTEM32>\net.exe stop CSIScanner
<SYSTEM32>\net1.exe stop CSIScanner
<SYSTEM32>\sc.exe config CSIScanner start= disabled
<SYSTEM32>\net1.exe stop MsMpSvc
<SYSTEM32>\net1.exe stop K7RTScan
<SYSTEM32>\sc.exe delete K7RTScan
<SYSTEM32>\sc.exe stop K7TSMngr
<SYSTEM32>\net.exe stop K7TSMngr
<SYSTEM32>\net.exe stop K7RTScan
<SYSTEM32>\sc.exe delete MsMpSvc
<SYSTEM32>\sc.exe config K7RTScan start= disabled
<SYSTEM32>\sc.exe stop K7RTScan

Injects code into

the following system processes:

%WINDIR%\Explorer.EXE

Terminates or attempts to terminate

the following user processes:

zlclient.exe
GUARD.EXE

Searches for windows to

detect analytical utilities:

ClassName: 'PROCMON_WINDOW_CLASS' WindowName: 'Process Monitor - Sysinternals: www.sysinternals.com'

detect programs and games:

ClassName: 'gdkWindowToplevel' WindowName: 'The Wireshark Network Analyzer'

Hides the following processes:

<Full path to virus>
<SYSTEM32>\MsRfClient.exe

Modifies file system :

Creates the following files:

%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\debug[1].zip
<SYSTEM32>\MsRfClient.exe

Sets the 'hidden' attribute to the following files:

<SYSTEM32>\MsRfClient.exe

Deletes itself.

Network activity:

Connects to:

'co##.##nts0m3mor3.com':80

TCP:

HTTP GET requests:

co##.##nts0m3mor3.com/net/debug.zip

UDP:

DNS ASK ns###.##rfingsuppliesco.net
DNS ASK ns###.##dsurfingsupply.net
DNS ASK ns###.#aveitallbaby.com
DNS ASK co##.##nts0m3mor3.com
DNS ASK ns##.###tysurfboards.net
DNS ASK ns###.##rfthewavesinc.net
'<Private IP address>':1038
'<Private IP address>':1035

Miscellaneous:

Searches for the following windows:

ClassName: '#32770' WindowName: 'Regshot 1.8.2'
ClassName: 'PROCEXPL' WindowName: ''
ClassName: 'TCPViewClass' WindowName: ''

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical Information

Recommandations pour le traitement

Free trial