Virus Detail

Description

Back to top

Method of Infection

When first run, Agobot.AMT copies itself to the %System% directory as FENSVC32.EXE. It also adds registry entries to run this copy at Windows start:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\Fen Startups = "FENSVC32.EXE"
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices\Fen Startups = "FENSVC32.EXE"

Note: '%System%' is a variable location. Agobot determines the location of the current System folder by querying the operating system. The default installation location for the System directory for Windows 2000 and NT is C:\Winnt\System32; for 95,98 and ME is C:\Windows\System; and for XP is C:\Windows\System32.

Back to top

Method of Distribution

Via Network Shares

This is the most common method of spreading, used by virtually all Agobots. It attempts to connect to default administrative shares, such as admin$, C$, D$, E$ and print$, by guessing usernames and passwords that may have access to these shares.

The following are some common user names that Agobot tries:
Administrator
Administrateur
Coordinatore
Administrador
Verwalter
admin
administrator
Default
Convidado
mgmt
Standard
User
Administratör
administrador
Owner
user
server
Test
Guest

These are some passwords that Agobot often tries to use:
admin
Admin
password
Password
1
12
123
pass
passwd
database
abcd
oracle
sybase
server
computer
Internet
root
sex
god
foobar

Note: the above is only a partial list. It is important to use strong passwords, especially for accounts with administrator privileges.

If Agobot successfully copies itself to a remote machine, it then launches the copy. It can do this by creating a service, or scheduling a job on the remote system.

Via Exploits

Win32.Agobot.AMT can also spread by exploiting vulnerabilities in Windows operating systems. Agobot performs IP scans in order to locate vulnerable target machines. This variant of Agobot attempts to exploit the following vulnerabilities:

1. Microsoft Windows RPCSS malformed DCOM message buffer overflow vulnerabilities (TCP port 135)
 http://www3.ca.com/threatinfo/vulninfo/vuln.aspx?ID=25975

2. Microsoft Windows RPC malformed message buffer overflow vulnerability (TCP ports 135, 445, 1025)
 http://www3.ca.com/threatinfo/vulninfo/vuln.aspx?ID=25454

3. Microsoft Windows LSASS buffer overflow vulnerability (ports 135, 445, 1025)
 http://www3.ca.com/threatinfo/vulninfo/vuln.aspx?id=27886

In some cases, the worm also listens on a local port and instructs the exploited target machine to connect back to it, to retrieve the worm's executable file.

Back to top

Payload

Backdoor Functionality

Agobot's main function is to act as an IRC controlled backdoor. It attempts to connect to an IRC server from a pre-defined list and join a specific channel so that the victim's computer can be controlled.

Once the victim's computer is under control, the overseer is able to instruct Win32.Agobot to attempt to perform malicious operations such as spreading via administrative shares with weak passwords or the DCOM RPC exploit. The backdoor can also be instructed to:

• download and execute files from the Internet
• retrieve system information such Operating System details
• execute local files
• perform DNS lookups

Terminates Processes

Win32.Agobot.AMT terminates the following processes (often associated with antivirus and other security-related applications) on an affected machine:

Modifies Hosts File

Win32.Agobot.AMT modifies to hosts file (usually found in %Windows%\hosts or %System%\drivers\etc\hosts), in order to redirect particular antivirus related domain names. For example:

127.0.0.1 www.ca.com
127.0.0.1 ca.com
127.0.0.1 mast.mcafee.com
127.0.0.1 my-etrust.com
127.0.0.1 www.my-etrust.com

These lines will cause the domains www.ca.com, ca.com, etc. to resolve to the local host, effectively denying access.

Steals CD Keys

This variant of Agobot may also search for and collect CD keys for popular PC games such as Half Life.

Analysis by Hamish O'Dea and Taras Malivanchuk

Back to top