WORM_SDBOT.SLS

This worm arrives by connecting affected removable drives to a system. It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

It executes commands from a remote malicious user, effectively compromising the affected system.

Arrival Details

This worm arrives by connecting affected removable drives to a system.

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This worm drops the following copies of itself into the affected system:

• %Windows%\unek.exe

(Note: %Windows% is the Windows folder, which is usually C:\Windows or C:\WINNT.)

It drops the following file(s)/component(s):

• %User Temp%\removeMe{4 numbers}.bat

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003.)

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• MEY3A0MW2

Autostart Technique

This worm adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
MSN = "%Windows%\unek.exe"

Propagation

This worm creates the following folders in all removable drives:

• RECYCLER
• RECYCLER\S-1-6-21-2434476501-1644491937-600003330-1213

It drops the following copy(ies) of itself in all removable drives:

• RECYCLER\S-1-6-21-2434476501-1644491937-600003330-1213\unek.exe

It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

The said .INF file contains the following strings:

[autorun]
open=RECYCLER\S-1-6-21-2434476501-1644491937-600003330-1213\unek.exe
icon=%SystemRoot%\system32\SHELL32.dll,4
action=Open folder to view files
shell\open=Open
shell\open\command=RECYCLER\S-1-6-21-2434476501-1644491937-600003330-1213\unek.exe
shell\open\default=1

Backdoor Routine

This worm connects to any of the following IRC server(s):

• unek.{BLOCKED}p3.com

It joins any of the following IRC channel(s):

• #unk

It executes the following commands from a remote malicious user:

• Update copy
• Download other files
• Execute a file
• Check malware's status
• DDOS attacks
• SYN flood attacks
• Stop and start a thread
• Make a bot join a channel
• Generate a random nickname
• Terminate the bot
• Disconnect the bot from IRC
• Send a message to the IRC server
• Issue Ping attack on to a target computer