WORM_SDBOT.MAL

This worm arrives via removable drives. It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This worm arrives via removable drives.

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This worm drops the following copies of itself into the affected system:

• %Windows%\system\slass.exe

(Note: %Windows% is the Windows folder, where it usually is C:\Windows on all Windows operating system versions.)

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• rtkjhi4568h96894H3G8H38958934hy9t3h498hy548hgmnhnf,ggsdfg4ww3333...

Autostart Technique

This worm registers itself as a system service to ensure its automatic execution at every system startup by adding the following registry entries:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\netmanlr
ObjectName = LocalSystem

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\netmanlr
Description = "Manage Local and Remote Network Connections Services. If this service is stopped, protected content might not be down loaded to the device."

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\netmanlr
ImagePath = "%Windows%\system\slass.exe"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\netmanlr
DisplayName = Network Connections Manage

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\netmanlr
Start = "2"

It adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Shell Extensions
systemxstuff = "{Malware path}\{Malware name}.exe"

Other System Modifications

This worm adds the following registry entries:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile
EnableFirewall = "0"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\wscsvc
Start = "4"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\wuauserv
Start = "4"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SharedAccess
Start = "2"

Propagation

This worm creates the following folders in all removable drives:

• {Removable drive letter except A and B}:\RECYCLER\S-1-6-21-2434476501-1644491937-600003330-1213

It drops the following copy(ies) of itself in all removable drives:

• {Removable drive letter except A and B}:\RECYCLER\S-1-6-21-2434476501-1644491937-600003330-1213\autorunme.exe

It uses the following user name and password to gain access to password-protected shares:

• "administrator"
• "administrador"
• "administrateur"
• "administrat"
• "admins"
• "admin"
• "adm"
• "password1"
• "password"
• "passwd"
• "pass1234"
• "pass"
• "pwd"
• "007"
• "12"
• "123"
• "1234"
• "12345"
• "123456"
• "1234567"
• "12345678"
• "123456789"
• "1234567890"
• "2000"
• "2001"
• "2002"
• "2003"
• "2004"
• "test"
• "guest"
• "none"
• "demo"
• "unix"
• "linux"
• "changeme"
• "default"
• "system"
• "server"
• "root"
• "null"
• "qwerty"
• "mail"
• "outlook"
• "web"
• "www"
• "internet"
• "accounts"
• "accounting"
• "home"
• "homeuser"
• "user"
• "oem"
• "oemuser"
• "oeminstall"
• "windows"
• "win98"
• "win2k"
• "winxp"
• "winnt"
• "win2000"
• "qaz"
• "asd"
• "zxc"
• "qwe"
• "bob"
• "jen"
• "joe"
• "fred"
• "bill"
• "mike"
• "john"
• "peter"
• "luke"
• "sam"
• "sue"
• "susan"
• "peter"
• "brian"
• "lee"
• "neil"
• "ian"
• "chris"
• "eric"
• "george"
• "kate"
• "bob"
• "katie"
• "mary"
• "login"
• "loginpass"
• "technical"
• "backup"
• "exchange"
• "fuck"
• "bitch"
• "slut"
• "sex"
• "god"
• "hell"
• "hello"
• "domain"
• "domainpass"
• "domainpassword"
• "database"
• "access"
• "dbpass"
• "dbpassword"
• "databasepass"
• "data"
• "databasepassword"
• "db1"
• "db2"
• "db1234"
• "sa"
• "sql"
• "sqlpassoainstall"
• "orainstall"
• "oracle"
• "ibm"
• "cisco"
• "dell"
• "compaq"
• "siemens"
• "hp"
• "nokia"
• "xp"
• "control"
• "office"
• "blank"
• "winpass"
• "main"
• "lan"
• "internet"
• "intranet"
• "student"
• "teacher"
• "staff"

Backdoor Routine

This worm connects to any of the following IRC server(s):

• oak.{BLOCKED}me.net
• {BLOCKED}.{BLOCKED}.179.100
• ringc.{BLOCKED}led.net
• {BLOCKED}arc.{BLOCKED}e.st
• gloves.{BLOCKED}o.org
• picc.{BLOCKED}s.net
• oak.{BLOCKED}me.net
• helms.{BLOCKED}o.org
• sandtp.{BLOCKED}nkiller.com
• computercc.{BLOCKED}list.com
• headmefc.{BLOCKED}As.com
• onthebreak.{BLOCKED}s.com

It joins any of the following IRC channel(s):

• #naga2

It accesses a remote Internet Relay Chat (IRC) server where it receives the following commands from a remote malicious user:

• Terminate itself
• Leave/join IRC channel
• Terminate itself
• Get list of currently running command threads
• Create/terminate threads
• Start/stop ddos attacks:
  • udp flood
  • tcp flood
  • icmp flood
  • bandwidth flood
  • syn flood
• Perform ping command
• Visit websites using Internet Explorer
• Patches %System%\drivers\tcpip.sys as itself
  (Note: %System% is the Windows system folder, which is usually C:\Windows\System32. For 32-bit applications running under 64-bit system, this is usually C:\Windows\SysWOW64.)
• Perform IRC commands
• Gathers information of the affected system:
  • hostname
  • host address
• Make an affected system the IRC server
• Flush DNS cache
• Get the IP address of the affected system using the following urls:
  • http://checkip.dyndns.org
  • http://checkip.dyndns.com
  • http://checkip.dyndns.org:8245
  • http://checkrealip.com
  • http://www.ip138.com/ips8.asp
  • http://www.canaan-it.net
• Scan for open ports either sequentially or randomly
• Adds/Deletes user in network Administrator group

Dropping Routine

This worm drops the following files:

• {Removable drive letter except A and B}:\autorun.inf
• {Removable drive letter except A and B}:\RECYCLER\S-1-6-21-2434476501-1644491937-600003330-1213\Desktop.ini

Information Theft

This worm gathers the following data:

• OS Version Info
• OS Service Pack
• OS Locale Info
• Computer Name

Other Details

This worm does the following:

• Terminates itself if the affected system's username is any of the following:
  • CurrentUser
  • Crrentuser
  • Honey
  • Sandbox
  • VMWare
• Terminates itself if the currently running malware's name is:
  • sample.exe
• Terminates itself if the following modules are present/loaded:
  • SbieDLL.dll
  • dbghelp.dll

It uses the following credentials when accessing its IRC server:

• USER: "{OS Service Pack}-{3 random numbers} * 0 :{Computer Name}"
• NICK: "{LocaleInfo}|{OS Version}|{OS Service Pack}|{6 random numbers}"
• PASS: ""