arrow_back
search
close

TROJ_TWEBOT.STB

May 13, 2010
 Analysis by: Erika Bianca Mendoza
 PLATFORM:

Windows 98, ME, NT, 2000, XP, Server 2003

 OVERALL RISK RATING:
 DAMAGE POTENTIAL:
 DISTRIBUTION POTENTIAL:
 REPORTED INFECTION:

  • Threat Type: Trojan

  • Destructiveness: No

  • Encrypted: No

  • In the wild: Yes

  OVERVIEW

This Trojan has received attention from independent media sources and/or other security firms.

To get a one-glance comprehensive view of the behavior of this Trojan, refer to the Threat Diagram shown below.

This Trojan may arrive bundled with malware packages as a malware component. This file may be downloaded intentionally by a user from the Internet.

It is used by TwitterNET Builder.exe, a file detected as TROJ_TWEBOT.BLD, to create the Twitter bot server file, TwitterNet.exe. Trend Micro also detects this server file as TROJ_TWEBOT.STB.

Once the server is running on a system, it regularly connects to the target Twitter user to read the attacker's tweets. These tweets can be commands for the botnet.

This Trojan may arrive bundled with malware packages as a malware component. It may be unknowingly downloaded by a user while visiting malicious websites.

  TECHNICAL DETAILS

File Size:

179,712 bytes

File Type:

PE

Memory Resident:

Yes

Initial Samples Received Date:

13 May 2010

Payload:

Turns systems into proxy servers

Arrival Details

This Trojan may arrive bundled with malware packages as a malware component.

It may be unknowingly downloaded by a user while visiting malicious websites.

Other Details

Based on analysis of the codes, it has the following capabilities:

  • Connects to the target Twitter user to read the attacker's tweets.These tweets can be commands for the botnet. Some of these commands are as follows:
    • .DOWNLOAD*{link}*[0/1] - This command orders the bot servers to download a file from a specified link. If a 0 (zero) is appended in the URL, it downloads the file only. Else, if the appended number is 1, the bot downloads and executes the file.
    • .DDOS*{IP}*{UDP port} - This command orders the bot servers to launch a UDP distributed denial of service (DDoS) attack to the declared IP address.
    • .VISIT*{link}*[0/1] - The .visit command connects the botnet servers to the link. The 0 (zero) at the end keeps the Internet browser hidden, and the 1 at the end makes the browser visible. An attacker can use this command to open a malicious site or cause confusion at the victim's end when a funny or scary website is opening about every 20 seconds.
    • .SAY*{message} - This command allows the bot servers to use the Text-to-Speech application of Microsoft Windows to read the tweet. It keeps repeating the message every 20 seconds until a .STOP command tweet is issued.
    • .STOP - This command stops all activities of connected bot servers.
    • .REMOVEALL - This commands removes all connected bot servers.
  • Creates the Twitter bot server file, TwitterNet.exe, that Trend Micro also detects as TROJ_TWEBOT.STB.

It displays the following images:


  SOLUTION

Minimum Scan Engine:

8.900

VSAPI OPR PATTERN File:

7.167.00

VSAPI OPR PATTERN Date:

14 May 2010

Step 1

For Windows XP and Windows Server 2003 users, before doing any scans, please make sure you disable System Restore to allow full scanning of your computer.

Step 2

Remove malware files dropped/downloaded by TROJ_TWEBOT.STB

Step 3

Scan your computer with your Trend Micro product to delete files detected as TROJ_TWEBOT.STB. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check this Knowledge Base page for more information.


Did this description help? Tell us how we did.

Related Malware