WORM_IRCBOT.AHR

This worm arrives by accessing affected shared networks. It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It propagates via shared networks and drops copies of itself into available networks.

It drops copies of itself in all removable drives.

Arrival Details

This worm arrives by accessing affected shared networks.

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This worm drops the following files:

• %User Profile%\My Documents\nt.bat

(Note: %User Profile% is the current user's profile folder, which is usually C:\Windows\Profiles\{user name} on Windows 98 and ME, C:\WINNT\Profiles\{user name} on Windows NT, and C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003.)

It drops the following copies of itself into the affected system:

• %User Temp%\z1x2c3v.exe
• %User Profile%\My Documents\Windows\Windows\svchostPKS\{random number}\svchost.exe

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003.. %User Profile% is the current user's profile folder, which is usually C:\Windows\Profiles\{user name} on Windows 98 and ME, C:\WINNT\Profiles\{user name} on Windows NT, and C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003.)

It creates the following folders:

• %User Profile%\My Documents\Windows\Windows\svchostPKS
• %User Profile%\My Documents\Windows\Windows\svchostPKS\{random number}

(Note: %User Profile% is the current user's profile folder, which is usually C:\Windows\Profiles\{user name} on Windows 98 and ME, C:\WINNT\Profiles\{user name} on Windows NT, and C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003.)

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• 4556654564565465665465645g1g11g1444uuu

Autostart Technique

This worm adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Windows Services = %User Profile%\My Documents\Windows\Windows\svchostPKS\{random number}\svchost.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Windows Services = %User Profile%\My Documents\Windows\Windows\svchostPKS\{random number}\svchost.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Terminal Server\
Install\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Windows Services = %User Profile%\My Documents\Windows\Windows\svchostPKS\{random number}\svchost.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\ShellServiceObjectDelayLoad
Windows Services = %User Profile%\My Documents\Windows\Windows\svchostPKS\{random number}\svchost.exe

It modifies the following registry entries to ensure it automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Winlogon
Shell = Explorer.exe "%User Profile%\My Documents\Windows\Windows\svchostPKS\{random number}\svchost.exe"

(Note: The default value data of the said registry entry is Explorer.exe.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Winlogon
Userinit = %System%\userinit.exe "%User Profile%\My Documents\Windows\Windows\svchostPKS\{random number}\svchost.exe"

(Note: The default value data of the said registry entry is %System%\userinit.exe,.)

Other System Modifications

This worm adds the following registry entries:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SharedAccess\Parameters\
FirewallPolicy\DomainProfile\AuthorizedApplications\
List
%User Profile%\My Documents\Windows\Windows\svchostPKS\{random number}\svchost.exe = "%User Profile%\My Documents\Windows\Windows\svchostPKS\{random number}\svchost.exe":*:Enabled:Windows

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\AuthorizedApplications\
List
%User Profile%\My Documents\Windows\Windows\svchostPKS\{random number}\svchost.exe = "%User Profile%\My Documents\Windows\Windows\svchostPKS\{random number}\svchost.exe":*:Enabled:Windows

File Infection

This worm propagates via shared networks and drops copies of itself into available networks.

Propagation

This worm drops copies of itself into the following folders used in peer-to-peer (P2P) networks:

• Software\rrrrrr444444444rrrrrrr445r4\rrrrrr444444444rrrrrrr445r4\Downloads
• \Downloads\
• \Downloads\e4e4e4e44e4e4344354345\Incoming\
• \Mis archivos recibidos\
• \My Shared Folder\
• \My recived files\
• \Shared\
• \a4a4a\my a4a4a\
• \e4e4e4e44e4e4344354345\incoming\
• \ffffffffff4r44r4r4r4e773773\shared folder\
• \kkkkkkkkk5hj465gh4jg5h4j8jh\files\
• \ooo5465o654o54o4o44o4oooo lite k++\my shared folder\
• \ooo5465o654o54o4o44o4oooo lite\my shared folder\
• \ooo5465o654o54o4o44o4oooo\my shared folder\
• \sdf4df65d4s44545554\my shared folder\
• \tttreww54d4d44d\shared\
• \tttttttt5t4t44t4t4t4t5t45t4\incoming\
• \ttttttttt56d456er4544344\shared\
• \zzx4x4x44s5\shared\

It searches the network for the following shared networks onto which it attempts to drop copies of itself:

• ADMIN$
• C$
• D$
• d$
• e$
• IPC$
• PRINT$

It drops copies of itself in all removable drives.

It uses the following file names for the copies it drops into shared networks:

• facebook.exe
• msn.exe
• setup.exe

NOTES:
This malware connects to the following remote IRC server using port 6667:

• {BLOCKED}t.{BLOCKED}h.com

• Local Information
• Operating System Name
• Operating System Version
• System Uptime

• USER: {country abbreviation} {operating system name} * : {machine name}
• NICK: N|{country abbreviation}|{operating system name}|{system uptime}|{random number}

• ##sexo##

If the connection with the IRC server is successful, it malware will now receive bot commands from the remote server to execute in the affected system. The following are the bot commands used by the malware to perform malicious routines in the infected system:

• .cambiar
• .download
• .firefox
• .hfadd
• .hfdel
• .hfdelip
• .hflist
• .info
• .kill
• .login
• .logout
• .p0p
• .rar
• .reconnect

• Download and execute files
• Modify hosts file
• Propagate itself
• Reconnect to the affected machine
• Retrieve system information
• Terminate itself and remove its winlogon registries
• Update itself