Virus Detail

Description

Back to top

Method of Infection

To infect a machine, the trojan copies itself to %System%\wintems.exe before dropping two DLL files. These files have been identified as:

%System%\forõ.exe (27,136 bytes) and %System%\noat.exe (16,384 bytes).

Note: '%System%' is a variable location. The worm determines the location of the current System folder by querying the operating system. The default installation location for the System directory for Windows 2000 and NT is C:\Winnt\System32; for 95,98 and ME is C:\Windows\System; and for XP is C:\Windows\System32.

The various components are used in the following way:

Once executed, wintems.exe injects noat.exe into Explorer.exe, which in turn loads forõ.exe, containing the main functionality of the trojan. This allows the trojan to run under the guise of the Windows process Explorer.exe.

Mitglieder.CT creates the following registry value so that it is run at each system startup:

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ssgrate.exe = "%System%\wintems.exe"

Back to top

Payload

SOCKS Proxy/Backdoor

Much like all Mitglieders, the CT variant opens a backdoor on port 38884 which acts as a SOCKS 4 proxy. Additionally, the backdoor can be instructed to perform varying tasks which include the following:

• Changing the backdoor port number
• Updating the trojan
• Downloading and execute files
• Uninstalling the trojan
• Initiating an SMTP server on TCP port 25, which can be used to relay spam.
• Executing files on the infected computer
• Downloading and executing files via a URL  

Terminates Processes

The trojan checks all running process names for instances of any of the following strings, terminating processes that match:

Contacts Sites

Mitglieder.CT periodically contacts the following sites with information pertaining to the infection of the machine. This includes the port on which the backdoor is running and the IP address of the infected machine. (Asterisks have been used to mask exact URL for privacy purposes).

http://www.lowenbrau.ru/manager_old/images/********
http://www.gasterixx.de/gfx/********
http://www.deadlygames.de/DG/BF/BF-Links/clans/********
http://www.eurostretch.ru/********
http://mir-auto.ru/********
http://artesproduction.com/********
http://www.hhc-online.de/home/links/pics/********
http://gaz-service.ru/img/pict/********
http://rdwufa.ru/img/pict/********
http://www.komandor.ru/sessions/********
http://www.mirage.ru/sport/omega/pic/omega/********
http://prizmapr.ru/test/images/********
http://avistrade.ru/prog/img/proizvod/********
http://service6.valuehost.ru/images/********
http://www.thomas-we.de/Design/********
http://partiyazerna.1gb.ru/menu/analitika/********
http://pvcps.ru/images/********
http://monomah-city.ru/vakans/********
http://mir-vesov.ru/p/lang/CVS/********
http://promco.ru/sovrem/panorama/********
http://www.13tw22rigobert.de/_themes/kopie-von-fantasie-in-blau/********
http://die-cliquee.de/inhalt/mitglieder/foto/********
http://plastikp.ru/img/********
http://www.levada.ru/htmlarea/images/********
http://multi-gaming.com/design/images/icons/********
http://www.metzgerei-gebhart.de/pic/********
http://www.ferienwohnung-in-masuren.de/bochmann/images/********
http://www.admlaw.ru/new/translations/********
http://egogo.ru/lj/0223/********
http://unbound.de/galerie/thumbnails/********
http://mc-figga.de/********
http://investexpo.ru/banners/********
http://www.etype.hostingcity.net/mysql_admin_new/images/********
http://tpoint.ru/sys/include/QuestionClasses/********
http://blackwidow.nsk.ru/group/zlyeyazyki/photos/********
http://www.emil-zittau.de/karten/********
http://www.ordendeslichts.de/intern/********
http://stroyindustry.ru/service/construction/********
http://vladzernoproduct.ru/control/sell/t/********
http://hannes-wacker.de/galerie/util/********
http://schiffsparty.de/bilder/uploads/********
http://sound-cell.de/prosite/pics/********
http://shop-of-innovations.de/media/********
http://bernlocher.de/cms/img/********
http://komtel.spb.ru/dk/old/using/********
http://www.gay-traffic.de/images/banner/********
http://www.progame.de/newtexte/_notes/********
http://st-agnes.de/geschichte/********
http://web298.server7.webplus24.de/********
http://gnet30.gamesnet.de/photogallery/photo25939/********
http://dabigbadboy.de/pass/********
http://roszvetmet.com/images/********

Downloads Files

Back to top

For additional information:

The trojan creates a mutex 'zorro' so that only one copy of itself runs at a time. It also creates the following registry values for its own use:

HKCU\SOFTWARE\DateTime9\Uid = <Unique ID>
HKCU\SOFTWARE\DateTime9\Port = <Port Number>
HKCU\SOFTWARE\DateTime9\wdrn = 1/0  - Indication of whether it is a new or old infection.

Analysis by Scott Molenkamp

Back to top