Virus Detail

Description

Back to top

Method of Infection

When executed, Esbot.C copies itself to %System%\wpa.exe, and adds the following service:

Service name: wpa
Display name: Windows Product Activation
Path to executable: %System%\wpa.exe
Startup type: Automatic

Service description: "Windows Product Activation is an anti-piracy technology designed to verify that software products have been legitimately licensed."

Note: '%System%' is a variable location. The malware determines the location of the current System folder by querying the operating system. The default installation location for the System directory for Windows 2000 and NT is C:\Winnt\System32; for 95,98 and ME is C:\Windows\System; and for XP is C:\Windows\System32.

The worm also creates a mutex called wpa to ensure only one copy runs at a time.

After installing itself, the worm starts an instance of explorer.exe and injects code into that process. This code deletes the original copy of the worm after it has run.

Back to top

Method of Distribution

Via Exploit

In order to spread, the worm attempts to exploit the Microsoft Windows Plug and Play service buffer overflow vulnerability. The worm searches IP addresses for potential targets, checking for vulnerable systems via port 445. It only does this if it is commanded to through its IRC controlled backdoor (see Payload section below for additional detail).

For more information on this vulnerability, please visit:

http://www3.ca.com/securityadvisor/vulninfo/vuln.aspx?id=33250
http://www.microsoft.com/technet/security/Bulletin/MS05-039.mspx

Back to top

Payload

Backdoor Functionality

The worm can be used as an IRC-controlled backdoor, allowing a remote user to gain unauthorized access to the infected machine.

The worm connects to an IRC server on port 37702 and joins a particular channel. It then waits for instructions from the channel. The worm can be instructed to perform the following actions on the affected machine:

• Scan for other machines to infect by exploiting the Microsoft Windows Plug and Play service buffer overflow vulnerability (see above).
• Launch Denial of Service attacks
• Download files using HTTP and execute them

Modifies System Settings via the Registry

The worm sets the following registry values:

HKLM\software\microsoft\ole\enabledcom = "n"
HKLM\system\currentcontrolset\control\lsa\restrictanonymous = 1

The first registry modification disables DCOM support in Windows.

The second registry modification disallows the enumeration of accounts from remote machines.

It also creates an empty file called %Windows%\Debug\dcpromo.log. This is a read-only file which can stop the Microsoft Windows LSASS buffer overflow vulnerability from being exploited. For more information on this vulnerability, please see:

http://www3.ca.com/threatinfo/vulninfo/vuln.aspx?ID=27886
http://www.microsoft.com/technet/security/Bulletin/MS04-011.mspx

These actions are most likely put in place by the worm in order to shield the machine from further compromise by other worms known to spread via network shares and by exploiting particular vulnerabilities, including the LSASS vulnerability mentioned above and the Microsoft Windows RPCSS malformed DCOM message buffer overflow vulnerabilities. For more information on this, please see:

http://www3.ca.com/threatinfo/vulninfo/vuln.aspx?ID=25975

Note: '%Windows%' is a variable location. The malware determines the location of the current Windows folder by querying the operating system. The default installation location for the Windows directory for Windows 2000 and NT is C:\Winnt; for 95,98 and ME is C:\Windows; and for XP is C:\Windows.

Analysis by Hamish O'Dea

Back to top