Backdoor:Win32/Rbot.KN

Installation

Spreads Via…

• Buffer overrun in server service (addressed in security bulletin MS06-040) (detected as Exploit:Win32/Crpexp.gen!A)
• Graphics Rendering Engine Vulnerability (addressed in security bulletin MS06-001) (detected as Exploit:Win32\Wmfap.A)
• DNS RPC Management Vulnerability (addressed in security bulletin MS07-029) (detected as Exploit:Win32/Siveras.E)
• Buffer Overrun in RPC Interface (addressed in security bulletin MS03-026, replaced by MS03-039) (detected as Exploit:Win32/RpcDcom.gen)
• RPC Buffer Overflow Vulnerability (addressed in security bulletin MS04-011) (detected as Exploit:Win32/Lsass.gen)

Payload

• Download arbitrary files, or visit web sites without downloading (i.e. “click” on the specified website)
• Execute files, either downloaded by the malware or already present on the system
• Update itself
• Spread by scanning the network for systems with security vulnerabilities or weak passwords
• Return system information and statistics, including lists of drivers, or running processes
• Terminate processes or delete files
• Search for files with particular filenames
• Transfer files between users connected to the IRC channel, or upload files to a specified FTP server
• Start a SOCKS proxy, TFTP server or HTTP server on the affected system. The TFTP and HTTP servers may be used to serve copies of the malware to newly targeted systems.
• Create a remote command line shell on the affected system
• Return the contents of the clipboard
• Attempt to obtain license keys of commercial software installed on the system
• Attempt to secure the system from attack by competing malware (or undo these changes)
• Participate in Distributed Denial of Service attacks
• Perform key logging
• Perform a screen capture, or webcam capture (still or video)
• Send e-mail messages
• Restart the system
• Flush the DNS cache
• Execute arbitrary IRC commands

• Disable DCOM
• Restrict anonymous access to the system
• Remove network shares