SonicWALL UTM Research team observed a new Autorun.inf worm variant starting on Monday, January 26, 2009 which has IRC Bot functionality and spreads via network shares or by exploiting windows vulnerabilities.

SonicWALL has received 7 copies of this network aware worm. It performs following activities when executed:

Host level activities

• Disables Task Manager
• Disables Registry Tools
• Disables Notifications for Firewalls and various AntiVirus Tools
• Copies itself to %windir%system32driversSCtri.exe and adds a registry entry for it to run every time system reboots
• Infects USB drive by dropping an autorun.inf file and a copy of itself SCtri.exe so that whenever user connects the infected USB drive on a machine with auto run enabled, the machine will get infected.
• Modifies the tcpip.sys file to conceal the network traffic from being captured locally by well-known sniffers (E.g. wireshark)
• It includes Anti-VM and Anti-Debugging code

Network level activities

• Scans the network for SMB shares with weak passwords and infects them. List of passwords it tries looks like following:
  • server
  • asdfgh
  • asdf
  • password
  • access
  • pass1234
  • administrador
  • 654321
  • 123456
  • 12345
  • 1234
  • root
  • admin
  • administrator
• Also spreads on the network of computers by exploiting Windows vulnerabilities: MS04-011 and MS08-067
• Tries to resolve multiple domains (baldmanpower.[com/net/org] and kutlufamily.com ) and connects to an IRC server on port 80 where it listens for the commands.
• It has the RxBot family IRC bot functionality.

The worm is also known as Exploit:Win32/MS06040.gen [Microsoft], IRC/SdBot trojan [ESET], and Worm/SdBot.735232.1 [AntiVir]

SonicWALL Gateway AntiVirus provides protection against this malware via GAV: SdBot.NW (Worm) signature [798 hits recorded].

SonicWALL UTM Research team observed a new variant of Waledac Trojan in the wild starting today Thursday, January 23, 2009. Waledac was first seen on the Internet a day before Christmas (Dec 24, 2009) and since then there were multiple variants spammed in the wild.

Waledac arrives via email that contains a link to the Trojan. A sample of URL spammed for the newest variant of Waledac looks like following:

• wlt.goodnewsdigital.com?cardnum=(REMOVED)

If the user clicks on the link, the Trojan will get downloaded with one of the following filename:

• onlyyou.exe
• love.exe
• you.exe
• youandme.exe
• meandyou.exe

The malware when executed, performs the following tasks:

• Adds the following registry key to ensure that the Trojan gets executed every time system reboots
  • HKLMSOFTWAREMicrosoftWindowsCurrentVersionRunPromoReg: “(PATH)(FILENAME)”

• Sends out email messages containing the Malicious URL to e-mail addresses harvested from local machine. It contained following IP Addresses encrypted inside the binary file:

  • 60.17.155.78
  • 201.2.164.168
  • 124.73.130.120
  • 71.10.230.45
  • 200.100.83.229
  • 119.96.206.189
  • 121.1.102.3
  • 124.199.31.108
  • 124.153.156.121

  Malware sends folling HTTP requests to the above IP addresses most of which has content-length of 957 bytes:

  • POST /zzmk.htm HTTP/1.1
  • POST /smphsfmsdll.htm HTTP/1.1
  • POST /xbqbqkhnd.htm HTTP/1.1
  • POST /zmqwyliet.png HTTP/1.1
  • POST /irpswjczfew.htm HTTP/1.1

  The malware has very low AV detection (2/32) at the time of writing this Security Alert. SonicWALL Gateway Antivirus will detect this new Waledac variant as GAV: Waledac.Z (Trojan) .

The TimesTen In-Memory Database product from Oracle is used for real-time data management in performance-critical environments. Amongst other applications, it can be used as a high performance cache for an Oracle Database.

The product includes various services that provide different functionalities and user access points. One of the services is a scaled down HTTP server ran on port 17000/TCP. A typical request that would be sent to the server is shown:

GET evtdump?msg=thisisatest HTTP/1.0rn
The TimesTen Database generates transaction logs of the HTTP connections. The log generation is enabled in the product in default installations. All transactions that fail as well as requests that are in any form invalid are logged by the service.

A format string vulnerability exists in the Oracle TimesTen Database product. The flaw is contained in the transaction logging function. The method that generates the logs does not sufficiently sanitize user input before internally passing it as arguments to printf-like functions. As a request comes in to the HTTP server, the URI is inspected for illegal character sequences such as format specifiers like “%n”. If any format specifiers are found in the URI then the request is considered invalid and as such, must be logged. Subsequently, it is passed onto the logging function without being sanitized. The logging function calls the snprintf function, passing the user supplied URI as the string parameter. Since the URI includes format sting specifiers, they get interpreted as such by the snprintf function. This results in memory corruption which may lead to either process flow diversion or a termination of the vulnerable service.

Remote unauthenticated users could exploit this flaw by sending a malicious request to the affected service. Successful exploitation may allow a malicious user to execute arbitrary code on the target host. SonicWALL has released an IPS signature to detect and block limited exploit attempts targeting this vulnerability. The following IPS signature has been released to address this vulnerability:

• 1318 – Oracle TimesTen In-Memory Database evtdump Format String Attempt

SonicWALL UTM Research team observed a new wave of the on-going UPS invoice spam campaign starting Wednesday, December 17, 2008. The email has a zip archived attachment which contains the new ZBot Trojan variant.

SonicWALL has received more than 1,500 e-mail copies of this malware till date. This malware is spread in the same way as the previous ZBot variant of Nov 21 (described here), but the sample has been updated to thwart antivirus detection.

The behavior is identical to the previous one, except this variant connects to download an encrypted configuration file from a different location:

* GAV: Zbot.GSV (Nov 21, 2008) – pavelmoous.ru/pavel/conf.bin
* GAV: Zbot.GAB (Dec 17, 2008) – reservpptppp20.ru/igor.bin

At this time only 6 antivirus vendors detect this malware.

The Trojan is also known as Trojan-Spy.Win32.Zbot.idq [Kaspersky], Mal/Zbot-G [Sophos], and TR/Spy.ZBot.IAX [AntiVir].

SonicWALL Gateway AntiVirus provides protection against this malware via GAV: Zbot.GAB (Trojan) and GAV: Zbot.GAA (Trojan) signatures.

The GAV: Zbot.GAB (Trojan) signature received more than 55,000 hits in the last 24 hours, demonstrating that this malware is very active in the wild at the moment. The following figure shows the hits per hour so far.