Threat Encyclopedia

W32/SDBot.1!worm

Analysis

• Copies itself to the System folder as update.exe.
  Registry Modification
  
• Adds the following registry entries:

  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
    Configuration Loader = "update.exe"
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Configuration Loader = "update.exe"

  
  Other Behavior
  
• Connects to the one of the following Internet Relay Chat (IRC) servers:
  
  • irc.undernet.org
  • LosAngeles.CA.US.Undernet.org
  • Oslo1.NO.EU.undernet.org
  
  on one of the following channels:
  
  • #DRX-ARMY
  • #DRX-ARMY2
  
  When connected, it listens for commands that allow the remote attacker to perform any of the following actions:
  
  • Download files
  • Send UPD, ICMP, and SYN packets to specified servers
  • Send information such as the following:
    
    • CPU type
    • Total RAM
    • Available RAM
    • OS version
    • User name

Recommended Action

FortiGate Systems

• Check the main screen using the web interface for your FortiGate unit to ensure that the latest AV/NIDS database has been downloaded and installed on your system - if required, enable the 'Allow Push Update' option.
  FortiClient Systems
  
• Quarantine/delete files that are detected and replace infected files with clean backup copies.

Telemetry