Submission Summary:

• Submission details:
• Submission received: 20 2007 22:47:11
• Processing time: 2 min 41 sec
• Submitted sample:
• File MD5: 0xE6C4776CB9AFFA027F20CAA9F68A5250
• Filesize: 180,224 bytes
• Alias: Backdoor.Win32.Rbot.adf [Kaspersky Lab], W32.Spybot.Worm [Symantec], BKDR_Generic [Trend Micro]

• Summary of the findings:

What's been found	Severity Level
A network-aware worm that uses known exploit(s) in order to replicate across vulnerable networks.
Bugtraq ID 9213: DameWare Mini Remote Control Server Pre-Authentication Buffer Overflow Vulnerability.
MS03-026: DCOM RPC Interface Buffer Overrun Vulnerability - replication across TCP 135/139/445/593 (common for Spybot, Randex, other IRC Bots).
MS04-012: DCOM RPC Overflow exploit - replication across TCP 135/139/445/593 (common for Blaster, Welchia, Spybot, Randex, other IRC Bots).
MS03-007: Microsoft IIS WebDAV Remote Compromise Vulnerability - Unchecked Buffer In Windows Component Could Cause Server Compromise.
MS04-011: LSASS Overflow exploit - replication across TCP 445 (common for Sasser, Bobax, Kibuv, Korgo, Gaobot, Spybot, Randex, other IRC Bots).
Capability to perform DoS attacks against other computers.
Backdoor functionality: connected remote users are able to perform multiple actions on the compromised system.
Capability to join IRC channels and communicate with the remote computers (e.g. with the purpose of notification or remote administration).
Capability to terminate Antivirus, Firewall and other security related processes.
Replication across networks by exploiting weekly restricted shares (common for Randex family of worms).
Creates a startup registry entry.
Contains characteristics of a known security risk.

Technical Details:

Possible Security Risk

• Attention! Characteristics of the following security risk was identified in the system:

File System Modifications

• The following files were created in the system:

• Notes:
• %Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).
• %System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

Memory Modifications

• There were new processes created in the system:

Registry Modifications

• The following Registry Keys were created:
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
• HKEY_CURRENT_USER\Software\Microsoft\OLE

• The newly created Registry Values are:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
• AdobeReaderPro = "rruxdkf.exe"

so that rruxdkf.exe runs every time Windows starts

• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
• AdobeReaderPro = "rruxdkf.exe"

so that rruxdkf.exe runs every time Windows starts

• [HKEY_CURRENT_USER\Software\Microsoft\OLE]
• AdobeReaderPro = "rruxdkf.exe"

• The following Registry Values were modified:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole]
• EnableDCOM = "N"
• [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa]
• restrictanonymous = 0x00000001
• [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
• restrictanonymous = 0x00000001

Other details

• To mark the presence in the system, the following Mutex object was created:
• l33t..&..h4ck3r

Heuristics Analysis

• Heuristically identified capability to terminate the following security related processes:

• Heuristically identified capability of spreading across the following weakly restricted network shares:

• The network replication uses a dictionary attack by probing credentials from the following list: