Method of Infection
When the main executable is launched, it copies itself to:
%Windows%\firewall_anti.exe
It makes the following modifications to the registry to ensure that "firewall_anti.exe" is executed at each Windows start:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\firewall_anti="%Windows%\firewall_anti.exe"
It also drops another component to %Windows%\firewall_anti.exe.dll (this file is 139,264 bytes in size). The file is a DLL, which is injected into the explorer.exe process, so as to run under the guise of Explorer.
Note: '%Windows%' is a variable location. The malware determines the location of the current Windows folder by querying the operating system. The default installation location for the Windows directory for Windows 2000 and NT is C:\Winnt; for 95,98 and ME is C:\Windows; and for XP is C:\Windows.
Back to top
Payload
Modifies Network Behavior
Win32.Fantibag.A contains a list of over 100 antivirus-related domain names. Presumably in order to stop users from visiting websites or downloading scanner updates from these domains. The trojan accomplishes this by creating both input and output filters to drop all packets between the user's machine and any of the filtered IP addresses.
For each of the specified domain names, a DNS lookup is performed. Win32.Fantibag will then create filters for each IP address within the same class C (255.255.255.0) network. Antivirus companies targeted include Computer Associates, McAfee, Sophos, Kaspersky, F-Secure, Trend, etc. The following domain names are also used to create IP filters (and are hence also blocked):
download.microsoft.com
downloads.microsoft.com
go.microsoft.com
msdn.microsoft.com
office.microsoft.com
support.microsoft.com
windowsupdate.microsoft.com
Analysis by Scott Molenkamp
Back to top