WORM_QAKBOT.BN
W32.Qakbot (Symantec); Backdoor:Win32/Qakbot (Microsoft); W32/Pinkslipbot.gen.af (Mcafee); Bck/Qbot.AO (Panda)
Windows 2000, Windows XP, Windows Server 2003
Threat Type: Worm
Destructiveness: No
Encrypted: No
In the wild: Yes
OVERVIEW
This worm arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.
It drops copies of itself in all removable drives.
TECHNICAL DETAILS
272,032 bytes
EXE
Yes
21 May 2011
Arrival Details
This worm arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.
Installation
This worm drops the following files:
- %System Root%\Documents and Settings\All Users\Application Data\Microsoft\{random characters}\{random characters}.dll - also detected as WORM_QAKBOT.BN
(Note: %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.)
It drops the following copies of itself into the affected system:
- %System Root%\Documents and Settings\All Users\Application Data\Microsoft\{random characters}\{random characters}.exe
(Note: %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.)
It creates the following folders:
- %System Root%\Documents and Settings\All Users\Application Data\Microsoft\{random characters}
(Note: %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.)
Autostart Technique
This worm adds the following registry entries to enable its automatic execution at every system startup:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
{random characters} = "%System Root%\Documents and Settings\All Users\Application Data\Microsoft\{random characters}\{random characters}.exe"
It modifies the following registry entries to ensure it automatic execution at every system startup:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
{legitimate application} = "%System Root%\Documents and Settings\All Users\Application Data\Microsoft\{random characters}\{random characters}.exe" /c {path and file name of legitimate application}"
(Note: The default value data of the said registry entry is {path and file name of legitimate application}.)
Propagation
This worm drops copies of itself in all removable drives.