BKDR_LOLBOT.JI
Windows 2000, Windows XP, Windows Server 2003
![](/vinfo/imgFiles/legend.jpg)
Threat Type: Backdoor
Destructiveness: No
Encrypted: No
In the wild: Yes
OVERVIEW
Dropped by other malware
This backdoor may be dropped by other malware.
It executes commands from a remote malicious user, effectively compromising the affected system.
It retrieves specific information from the affected system.
TECHNICAL DETAILS
85,504 bytes
EXE
Yes
01 Sep 2012
Compromises system security, Connects to URLs/IPs, Steals information
Arrival Details
This backdoor may be dropped by the following malware:
- TROJ_MDROP.JI
Installation
This backdoor drops the following non-malicious file:
- %Temp%\STZC47D8.TMP
(Note: %Temp% is the Windows Temporary folder, which is usually C:\Windows\Temp or C:\WINNT\Temp.)
Its DLL component is injected to the following process(es):
- SVCHOST.EXE
Autostart Technique
This backdoor registers itself as a system service to ensure its automatic execution at every system startup by adding the following registry entries:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\storage
Type = 110
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\storage
Start = 2
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\storage
ErrorControl = 1
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\storage
ImagePath = %SystemRoot%\System32\svchost.exe -k storage
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\storage
DisplayName = "Windows Storage"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\storage
ObjectName = "LocalSystem"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\storage
Description = "Storage service provides a fully redundant data storage infrastructure for storing and retrievingany amount of data."
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\storage\Parameters
ServiceDll = %Program Files%\Common Files\System\STRUNLIB.DLL
Backdoor Routine
This backdoor executes the following commands from a remote malicious user:
- Download File
- Upload File
- Perform remote shell
- Remove itself
- Reconnect to server
It connects to the following URL(s) to send and receive commands from a remote malicious user:
- {BLOCKED}.{BLOCKED}.194.93:443
- {BLOCKED}.{BLOCKED}.22.70:80
- {BLOCKED}on.dyndns.info:443
Dropping Routine
This backdoor drops the following files:
- %Program Files%\Common Files\System\STRUNLIB.DLL - also detected as BKDR_LOLBOT.JI
(Note: %Program Files% is the default Program Files folder, usually C:\Program Files.)
Information Theft
This backdoor retrieves the following information from the affected system:
- System Information
- Running Services
- Running Processes
- Network Configuration
Stolen Information
This backdoor saves the stolen information in the following file:
- %Temp%\SL{Random Characters}.TMP
- %Windows%\inf\isvc.PNF
(Note: %Temp% is the Windows Temporary folder, which is usually C:\Windows\Temp or C:\WINNT\Temp.. %Windows% is the Windows folder, which is usually C:\Windows or C:\WINNT.)
Other Details
This backdoor connects to the following URL(s) to check for an Internet connection:
- www.google.com
It connects to the following URL(s) to get the affected system's IP address:
- checkip.dyndns.org
SOLUTION
9.200
9.362.06
01 Sep 2012
9.363.00
01 Sep 2012
Step 1
For Windows XP and Windows Server 2003 users, before doing any scans, please make sure you disable System Restore to allow full scanning of your computer.
Step 2
Remove the malware/grayware file that dropped/downloaded BKDR_LOLBOT.JI
-
TROJ_MDROP.JI
Step 3
Restart in Safe Mode
Step 4
Delete this registry key
Important: Editing the Windows Registry incorrectly can lead to irreversible system malfunction. Please do this step only if you know how or you can ask assistance from your system administrator. Else, check this Microsoft article first before modifying your computer's registry.
- In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- storage
- storage
Step 5
Search and delete these files
- %Temp%\STZC47D8.TMP
- %Temp%\SL{Random Characters}.TMP
- %Windows%\inf\isvc.PNF
Step 6
Restart in normal mode and scan your computer with your Trend Micro product for files detected as BKDR_LOLBOT.JI. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check this Knowledge Base page for more information.
Did this description help? Tell us how we did.