Submission Summary:

• Submission details:
• Submission received: 20 2007 07:38:19
• Processing time: 2 min 48 sec
• Submitted sample:
• File MD5: 0x020FEF328FDB7385875085F5F9317AF4
• Filesize: 205,824 bytes
• Alias: Backdoor.Rbot [PCTools], Backdoor.Win32.Rbot.bdz [Kaspersky Lab], W32.Spybot.Worm [Symantec], WORM_Generic [Trend Micro]

• Summary of the findings:

What's been found	Severity Level
A network-aware worm that uses known exploit(s) in order to replicate across vulnerable networks.
MS05-039: RPC Plug and Play Vulnerability - Remote Code Execution and Local Elevation of Privilege (common for Zotob, Mytob).
MS04-012: DCOM RPC Overflow exploit - replication across TCP 135/139/445/593 (common for Blaster, Welchia, Spybot, Randex, other IRC Bots).
MS04-011: LSASS Overflow exploit - replication across TCP 445 (common for Sasser, Bobax, Kibuv, Korgo, Gaobot, Spybot, Randex, other IRC Bots).
Capability to perform DoS attacks against other computers.
Backdoor functionality: connected remote users are able to perform multiple actions on the compromised system.
Capability to join IRC channels and communicate with the remote computers (e.g. with the purpose of notification or remote administration).
Capability to terminate Antivirus, Firewall and other security related processes.
Replication across networks by exploiting weekly restricted shares (common for Randex family of worms).
Creates a startup registry entry.
Contains characteristics of a known security risk.

Technical Details:

Possible Security Risk

• Attention! Characteristics of the following security risk was identified in the system:

File System Modifications

• The following file was created in the system:

• Note:
• %System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

Memory Modifications

• There were new processes created in the system:

Registry Modifications

• The following Registry Keys were created:
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
• HKEY_CURRENT_USER\Software\Microsoft\OLE

• The newly created Registry Values are:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
• AdobeReaderPro = "lxlfsprrj.exe"

so that lxlfsprrj.exe runs every time Windows starts

• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
• AdobeReaderPro = "lxlfsprrj.exe"

so that lxlfsprrj.exe runs every time Windows starts

• [HKEY_CURRENT_USER\Software\Microsoft\OLE]
• AdobeReaderPro = "lxlfsprrj.exe"

Other details

• To mark the presence in the system, the following Mutex object was created:
• rx10B

Heuristics Analysis

• Heuristically identified capability to terminate the following security related processes:

• Heuristically identified capability of spreading across the following weakly restricted network shares:

• The network replication uses a dictionary attack by probing credentials from the following list: