TROJ_TWEBOT.STB
Windows 98, ME, NT, 2000, XP, Server 2003
![](/vinfo/imgFiles/legend.jpg)
Threat Type: Trojan
Destructiveness: No
Encrypted: No
In the wild: Yes
OVERVIEW
This Trojan has received attention from independent media sources and/or other security firms.
To get a one-glance comprehensive view of the behavior of this Trojan, refer to the Threat Diagram shown below.
![](http://www.trendmicro.com/vinfo/images/TROJ_TWEBOT_STB.jpg)
This Trojan may arrive bundled with malware packages as a malware component. This file may be downloaded intentionally by a user from the Internet.
It is used by TwitterNET Builder.exe, a file detected as TROJ_TWEBOT.BLD, to create the Twitter bot server file, TwitterNet.exe. Trend Micro also detects this server file as TROJ_TWEBOT.STB.
Once the server is running on a system, it regularly connects to the target Twitter user to read the attacker's tweets. These tweets can be commands for the botnet.
This Trojan may arrive bundled with malware packages as a malware component. It may be unknowingly downloaded by a user while visiting malicious websites.
TECHNICAL DETAILS
179,712 bytes
PE
Yes
13 May 2010
Turns systems into proxy servers
Arrival Details
This Trojan may arrive bundled with malware packages as a malware component.
It may be unknowingly downloaded by a user while visiting malicious websites.
Other Details
Based on analysis of the codes, it has the following capabilities:
- Connects to the target Twitter user to read the attacker's tweets.These tweets can be commands for the botnet. Some of these commands are as follows:
- .DOWNLOAD*{link}*[0/1] - This command orders the bot servers to download a file from a specified link. If a 0 (zero) is appended in the URL, it downloads the file only. Else, if the appended number is 1, the bot downloads and executes the file.
- .DDOS*{IP}*{UDP port} - This command orders the bot servers to launch a UDP distributed denial of service (DDoS) attack to the declared IP address.
- .VISIT*{link}*[0/1] - The .visit command connects the botnet servers to the link. The 0 (zero) at the end keeps the Internet browser hidden, and the 1 at the end makes the browser visible. An attacker can use this command to open a malicious site or cause confusion at the victim's end when a funny or scary website is opening about every 20 seconds.
- .SAY*{message} - This command allows the bot servers to use the Text-to-Speech application of Microsoft Windows to read the tweet. It keeps repeating the message every 20 seconds until a .STOP command tweet is issued.
- .STOP - This command stops all activities of connected bot servers.
- .REMOVEALL - This commands removes all connected bot servers.
- Creates the Twitter bot server file, TwitterNet.exe, that Trend Micro also detects as TROJ_TWEBOT.STB.
It displays the following images:
SOLUTION
8.900
7.167.00
14 May 2010
Step 1
For Windows XP and Windows Server 2003 users, before doing any scans, please make sure you disable System Restore to allow full scanning of your computer.
Step 3
Scan your computer with your Trend Micro product to delete files detected as TROJ_TWEBOT.STB. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check this Knowledge Base page for more information.
Did this description help? Tell us how we did.