WORM_SDBOT.FEY

This worm arrives via removable drives. It arrives by accessing affected shared networks. It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It monitors its autostart registry entries and re-creates them if they are deleted. This action allows this malware to continuously execute after restarting the affected system.

It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

It runs certain commands that it receives remotely from a malicious user. Doing this puts the affected computer and information found on the computer at greater risk.

It executes the downloaded files. As a result, malicious routines of the downloaded files are exhibited on the affected system. As of this writing, the said sites are inaccessible.

It terminates itself if it detects it is being run in a virtual environment.

Arrival Details

This worm arrives via removable drives.

It arrives by accessing affected shared networks.

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This worm drops the following copies of itself into the affected system:

• %System%\{9-random-letter filename}.exe

(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.)

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• sh0w-m3-wh4t-y0u-g0t-l1l-m4m4-6.1

It injects threads into the following normal process(es):

• %Windows%\explorer.exe

(Note: %Windows% is the Windows folder, where it usually is C:\Windows on all Windows operating system versions.)

It terminates the execution of the copy it initially executed and executes the copy it drops instead.

Autostart Technique

This worm adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Drawing System = "%System%\{9-random-letter}.exe"

It monitors its autostart registry entries and recreates them when they are deleted.

Other System Modifications

This worm adds the following registry entries:

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\AuthorizedApplications\
List
%System%\{9-random-letter filename}.exe = "%System%\{9-random-letter filename}.exe:*:Enabled:Drawing System"

Propagation

This worm drops the following copy(ies) of itself in all removable drives:

• {removable drive letter except A and B}:\{9-random-letter filename}.exe

It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

The said .INF file contains the following strings:

[AutoRun]
open={9-random-letter filename}.exe
shellexecute={9-random-letter filename}.exe
shell\Auto\command={9-random-letter filename}.exe
shell=Auto
[vvflagRun]
aabb=kdkfjdkfk1

Backdoor Routine

This worm joins any of the following IRC channel(s):

• #xwar

It executes the following command(s) from a remote malicious user:

• create random nickname for itself
• terminate/kill IRC application
• Logout
• Get IRC version
• Change IRC server
• Start/Stop scanning of threads, IP addresses in the network, open ports in specific IP address
• Reconnect to IRC server
• Check status
• Reboot system
• List threads
• List internet information
• List system information
• Get uptime of itself
• Flush DNS
• Ask for the current IP of itself
• Perform UDP Flooding
• Terminate/Kill Bot
• Download files
• Use command prompt

It accesses a remote Internet Relay Chat (IRC) server where it receives the following commands from a remote malicious user:

• mitm.{BLOCKED}tp.com

As of this writing, the said servers are currently inaccessible.

Download Routine

This worm downloads an updated copy of itself from the following website(s):

• http://www.{BLOCKED}te.com/backup/mitm.exe

It saves the files it downloads using the following names:

• C:\mitm.exe

It then executes the downloaded files. As a result, malicious routines of the downloaded files are exhibited on the affected system.

As of this writing, the said sites are inaccessible.

Other Details

This worm connects to the following URL(s) to check for an Internet connection:

• http://www.google.com

It terminates itself if it detects it is being run in a virtual environment.

It uses the following credentials when accessing its IRC server:

• NICK {Country}|{OS Version}|{Internet Connection}|{9 random numbers}

NOTES:

This worm adds itself in the archive files in all drives as {7-random-letter}.gif{41 spaces}.scr.