Slashdot Mirror

← Back to Stories (view on slashdot.org)

PhatBot Trojan Spreading Rapidly On Windows PCs

Posted by timothy on from the what-and-lose-all-my-pigeons dept.

prostoalex writes "The Washington Post alerts Windows users about a new peer-to-peer backdoor client that is installed maliciously on broadband-connected computers around Asia and the United States. The client is then used for distributed DOS attacks and sending out large amounts of spam. Phatbot, according to government sources, is installed on hundreds of thousands machines already. Phatbot snoops for passwords on infected computers and tries to disable firewall and antivirus software, albeit it is detectable by antivirus packages." An anonymous reader submits a link to this description of the beast.

4 of 645 comments (clear)

  1. nice features list by Anonymous Coward · · Score: 5, Informative

    # Has the ability to polymorph on install in an attempt to evade antivirus signatures as it spreads from system to system
    # Checks to see if it is allowed to send mail to AOL, for spamming purposes
    # Can steal Windows Product Keys
    # Can run an IDENT server on demand
    # Starts an FTP server to deliver the trojan binary to exploited hosts - ends the FTP session with the message "221 Goodbye, have a good infection :)."
    # Can run a socks, HTTP or HTTPS proxy on demand
    # Can start a redirection service for GRE or TCP protocols
    # Can scan for and use the following exploits to spread itself to new victims: * DCOM * DCOM2 * MyDoom backdoor * DameWare * Locator Service * Shares with weak passwords * WebDav * WKS - Windows Workstation Service
    # Attempts to kill instances of MSBlast, Welchia and Sobig.F
    # Can sniff IRC network traffic looking for logins to other botnets and IRC operator passwords
    # Can sniff FTP network traffic for usernames and passwords
    # Can sniff HTTP network traffic for Paypal cookies
    # Contains a list of nearly 600 processes to kill if found on an infected system.Some are antivirus software, others are competing viruses/trojans
    # Tests the available bandwidth by posting large amounts of data to the following websites:
    * www.st.lib.keio.ac.jp
    * www.lib.nthu.edu.tw
    * www.stanford.edu
    * www.xo.net
    * www.utwente.nl
    * www.schlund.net
    # Can steal AOL account logins and passwords
    # Can steal CD Keys for several popular games
    # Can harvest emails from the web for spam purposes
    # Can harvest emails from the local system for spam purposes

    1. Re:nice features list by KevCo · · Score: 5, Informative
      I can't imagine how many other programs require admin access to run

      I'm currently working at a company that is migrating to WinXP in a very locked down environment. Everyone is a user and software restriction policies only allow files to be executed from specific locations. Users have no write access to C: at all... all user profiles and data are on D: (which is not allowed to execute anything).

      My job is to make the apps work. It's horrible. We have to give write access to the app's dir in Program Files to probably 40% of the apps. Some apps require write access to the root of C:\. Many want to create/modify files in Windows and System32. Far too many insist on writing to HKLM and even HKCR.

      We repackage all the apps as MSIs and include the needed permissions changes in the installer. By the time the apps are loaded, most machines security have been drastically compromised.

  2. Re:Detection/Removal instructions? by pwroberts · · Score: 5, Informative

    From the article:

    "Manual Removal
    Look for the following registry keys:

    HKLM\Software\Microsoft\Windows\CurrentVersion\R un \Generic Service Process
    HKLM\Software\Microsoft\Windows\CurrentVe rsion\Run Services\Generic Service Process

    The associated binary may be srvhost.exe, svrhost.exe or a variation of the same. Kill the associated process in the Task Manager, then remove the "Generic Service Process" registry key. Remove the executable from the Windows system directory."

  3. Related links and info by DR+SoB · · Score: 5, Informative

    This is also known as the "Agobot"

    http://news.yahoo.com/fc?tmpl=fc&cid=34&in=tech& ca t=hackers_and_crackers

    http://www.f-secure.com/v-descs/agobot_fo.shtml

    Detailed Description

    First of all, this new variant has 'Phatbot3' identifier and there are a few 'phat' string in its body. This may indicate that this version was not made by the original Agobot backdoor author, who calls himself TheAgo, but by a different person/group who got the source code of this backdoor.

    The backdoor's file is a PE executable 115738 bytes long compressed with PE-Diminisher file compressor. The unpacked file's size is over 245 kilobytes.

    Installation to system

    The Agobot.FO backdoor copies itself as NVCHIP4.EXE file to Windows System folder and creates startup keys for this file in System Registry:
    [HKLM\Software\Microsoft\Windows\Curren tVersion\Ru n]
    "nVidia Chip4" = "nvchip4.exe"
    [HKLM\Software\Microsoft\Windows\Cu rrentVersion\Ru nServices]
    "nVidia Chip4" = "nvchip4.exe"

    This allows the backdoor's file to start with every Windows session. On Windows NT-based systems the backdoor can start as a service.
    Scanning for vulnerable computers

    The backdoor can scan subnets for exploitable computers and send a list of their IPs to the bot operator. The scan is performed on ports 80, 135 and 445 for RPC/DCOM (MS03-026), RPC/Locator (MS03-001) and WebDAV (MS03-007) vulnerabilities. The backdoor can also scan for computers infected with MyDoom worm (port 3127), Bagle worm (port 2745) and also for computers where DameWare remote system management software is installed (port 6129).

    Performing a DDoS attack
    The backdoor can perform the following types of DDoS (Distributed Denial of Service) attacks:
    * HTTP flood * SYN flood * UDP flood * ICMP flood
    When performing a DDoS attack, the backdoor uses 33 unique client identifiers including Mozilla, Wget, Scooter, Webcrawler and Google bot.

    The backdoor sends 256000 bytes of random data to the following websites and checks the response times:
    www.schlund.net
    www.utwente.nl
    www.xo.net
    www.stanford.edu
    www.lib.nthu.edu.tw
    www.st.lib.keio.ac.jp

    Collecting e-mail addresses
    The bot can harvest e-mail addresses. It has the functionality to read user's Address Book and send the list of e-mail addresses to the bot operator.

    Obtainint Registry info
    The backdoor has the functionality to obtain System Registry info from an infected computer. This is a new feature for Agobot backdoor. Information obtained from the Registry can give a hacker a full overview of an infected system.

    Spreading to local network
    Agobot backdoor can scan computers on local network and copy itself there. The scan is initiated by a remote hacker. When spreading to local network, Agobot.FO probes the following shares:
    admin$ c$ d$ e$ print$ c

    Agobot.FO tries to connect using the following account names:
    (SEE LINKS AT TOP FOR INFORMATION)

    When connecting, Agobot.FO uses the following passwords:
    (SEE LINKS AT TOP FOR DETAILS)

    If the worm succeeds connecting to the above listed shares, it copies itself to a remote share and attempts to start that file as a service. The alternative way of infecting a remote host is to create a scheduled task on a remote computer that will start the backdoor's file.

    Teminating processes of security and anti-virus programs
    Agobot.FO has a huge list of process file names hardcoded in its body. The backdoor tries to terminate processes that have the following names:
    (NAMES REMOVED SO POST WOULD WORK, FOLLOW LINKS AT TOP)

    This functionality allows the backdoor to successfully disable anti-virus and security software that can not detect this backdoor before it's file is started. In most cases special tools are required to clean a computer infected with this backdoor.

    Additionally the

    --
    Mod +5 Drunk