Worm:Win32/Mybandok.A is a worm that spreads via e-mail. It has backdoor functionalities and attempts to download files from certain Web sites.
Installation
Upon execution, Worm:Win32/Mybandok.A drops the following files:
- <system folder>\ali.exe - copy of this worm
- %temp%\message - garbage file that this worm opens in Notepad when it is run
Note - <system folder> refers to a variable location that is determined by the malware by querying the Operating System. The default installation location for the System folder for Windows 2000 and NT is C:\Winnt\System32; and for XP and Vista is C:\Windows\System32.
It then modifies the system registry so that its dropped copy runs every time Windows starts:
Adds value: "andk"
With data: "<system folder>\ali.exe"
To subkey: HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Adds value: "*andk"
With data: "<system folder>\ali.exe"
To subkey: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
It also creates the following registry entries as part of its installation routine:
Adds value: "remove"
With data: "an"
To subkey: HKCU\Software\Microsoft
Adds value: "ofk"
With data: "1"
Adds value: "bnhide"
With data: "1724|ali.exe|andk|443|x|"
To subkey: HKCU\Software\Microsoft\Windows\CurrentVersion
It creates the following mutexes:
- sexage2007
- onepointthreefour
Spreads Via...
E-mail Messages
Worm:Win32/Mybandok.A spreads by attaching a copy of itself in e-mail messages that it sends out.
It looks for e-mail addresses in files with the following extensions:
adb
asp
aspx
dbx
htm
html
php
pl
sht
tbb
txt
wab
It avoids sending e-mails to addresses containing the following strings in the user field:
accoun
admin
anyone
bsd
bugs
ca
certific
contact
feste
gold-certs
help
icrosoft
info
linux
listserv
me
no
nobody
noone
not
nothing
ntivi
page
postmaster
privacy
rating
root
samples
security
service
site
soft
somebody
someone
submit
support
the.bat
unix
webmaster
you
your
It also avoids sending e-mails to addresses containing the following strings in the domain field:
.gov
.mil
acd-group
acdnet.com
acdsystems.com
acketst
alcatel-lucent.com
apache
arin.
avp
berkeley
bluewin.ch
borlan
bpsoft.com
bsd
buyrar.com
debian
example
fido
firefox
fsf.
ghisler.com
gimp
gnu
gov.
honey
iana
ibm.com
icrosof
idefense
ietf
inpris
isc.o
isi.e
jgsoft
kernel
lavasoft
linux
math
messagelabs
mit.e
mozilla
msn.
mydomai
nodomai
panda
pgp
qualys
quebecor.com
redhat
rfc-ed
ruslis
secur
secure
security
sendmail
slashdot
sopho
sourceforge
sun.com
support
suse
syma
tanford.e
unix
usenet
utgers.ed
wireshark
The attachment containing the worm copy is usually named 'postcard.zip'. The executable inside the archive has one of the following file names:
postcard.bat
postcard.exe
postcard.pif
postcard.scr
Payload
Backdoor Functionality
Worm:Win32/Mybandok.A is capable of performing backdoor routines depending on commands from a remote attacker. Some of the actions it is capable of doing are the following:
- List/start/stop system services, processes, and modules
- Spawn a remote shell
- Log keystrokes/clipboard data
- Search and upload files
- Start an http/ftp server
- Get system registry/device/hardware information
It runs a hidden copy of Internet Explorer and injects code into it to connect to the following Web sites, possibly to listen for remote commands and send information to:
- qualys.serveblog.net
- qualys.thruhere.net
- qualysguard.org
Downloads Files
Worm:Win32/Mybandok.A checks Internet connectivity by connecting to 'google.com'.
It tries to download the following files from certain Web sites:
- sex.com/hookdll.dll - saved as '%windir%\bhookpl.dll'
- love.com/ban.php - saved as '<system drive>\xxx.html'
Analysis by Jireh Sanico
