Worm:Win32/Slenfbot.AO is a worm that can spread via MSN Messenger. The worm also contains backdoor functionality that allows unauthorized access to an affected machine. This worm does not spread automatically upon installation, but must be ordered to spread by a remote attacker.
Installation
When executed, Worm:Win32/Slenfbot.AO copies itself to the <system folder> as "monsys.exe" and sets the attributes for this copy to read only, hidden and system. It modifies the registry to run this copy at each Windows start:
Adds value: "Microsoft System Monitor"
With data: "monsys.exe"
To subkey: HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Note - <system folder> refers to a variable location that is determined by the malware by querying the Operating System. The default installation location for the System folder for Windows 2000 and NT is C:\Winnt\System32; and for XP and Vista is C:\Windows\System32.
The worm makes a further registry modification that causes the copy of the worm that was executed originally to be deleted when the system restarts:
Sets value: "PendingFileRenameOperations"
With data: "<original malware executable>"
Under key: HKLM\System\CurrentControlSet\Control\Session Manager
However, it also runs "cmd.exe /c del <original malware executable> nul" to immediately delete the original copy of the worm.
Spreads Via…
MSN Messenger
This worm can be ordered to spread via Messenger by a remote attacker using the worm's backdoor functionality (see Payload below for additional detail). When the attacker orders the worm to spread via MSN Messenger, they must provide the following three parameters:
- A URL containing a list of possible messages to send, along with the worm itself, to MSN Messenger contacts. The worm chooses from this list at random.
- A file name for a ZIP archive. The worm creates a ZIP archive containing a copy of itself in the temporary folder with this name. The worm sends this ZIP archive to MSN Messenger contacts.
- A file name for the worm's executable inside the ZIP archive.
Payload
Backdoor Functionality: TCP Port 7601
Slenfbot.AO attempts to connect to an IRC server at ns1.asiaincorporated.info via TCP Port 7601, join a channel and wait for commands. Using this backdoor, an attacker can perform the following actions on an affected machine:
- remove itself
- join another IRC channel
- download and execute arbitrary files
- spread via MSN Messenger
- send arbitrary files via MSN Messenger
When the attacker orders the worm to send an arbitrary file via MSN Messenger, they must provide all of the parameters used when spreading vis Messenger, plus a fourth:
- A URL for a file to download. The worm places this file in the ZIP archive, which it sends to MSN Messenger contacts, in place of itself.
Additional Information
Slenfbot.AO creates the mutex "V3.2".
