Net-Worm.Win32.Padobot.z

Technical Details

This network worm infects computers running Windows. The worm itself is a Windows PE EXE file 46592 bytes in size. It propagates via the Microsoft Windows LSASS vulnerability, which is detailed in Microsoft Security Bulletin MS04-011

Installation

Once launched, the worm copies itself to the Windows system directory under a random name, e.g:

%System%\Chdmla32.exe

It also creates the following files:

• C:\boot.sys - (approx. 16 KB). This file is infected with Trojan-Spy.Win32.Qukart.s
• %System%\<random file name>.dll - (approx. 6 KB). This file is infected with Net-Worm.Win32.Padobot.z
• %System%\drivers\ndisrd.sys - (approx. 15 KB). This file is clean.
• %System%\<random file name>.exe - (approx. 14 KB). This file is infected with Net-Worm.Win32.Padobot.z
• %System%\<random file name>.dll - (approx. 11 KB). This file is infected with Trojan-Spy.Win32.Qukart.s

It creates the following entries in the system registry:

[HKCR\CLSID\{random CLSID number}\InprocServer32]
(default) = "%System%\<random file name>.dll"

[HKLM\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"<random value>" = {random CLSID value} 

[HKCU\Software\Microsoft\Windows]
"ifc" = "0x00000000" 

Propagation

The worm selects IP addresses to attack and sends a request to TCP port 445. If the remote machine responds, the worm will launch its code on this machine by exploiting the LSASS vulnerability.

Payload

The worm terminates some processes connected with antivirus software and firewalls.

It also tracks Internet Explorer activity, and saves information about which sites are visited, and then sends this information to a remote malicious user.