Virus

W32/RBot.FL!worm

Analysis


Specifics
This is a remote access Trojan which can receive instructions from malicious users. This 32-bit threat has a file size of 98,886 bytes. It will also download adware components from hosted websites. This threat will bind to TCP port 30108 and connect to the IP address 129.219.137.67.


Loading At Windows Startup
If the virus can successfully copy itself to any of these shares, it will then attempt to launch the copied virus. When the virus runs, it will register itself to auto-run at Windows startup-
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\
Microsoft Update Machine = windowsu.exe

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\
Microsoft Update Machine = windowsu.exe

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices\
Microsoft Update Machine = windowsu.exe


The virus makes an additional registry changes -

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\
"restrictanonymous" = 1

HKEY_LOCAL_MACHINE\Software\Microsoft\OLE\
EnableDCOM = N

IRC Connection
The virus may attempt to connect with an IRC server using TCP port 30108. Once connected the virus joins the channel '##dcom##' and awaits instructions.


Adware Download
This threat will attempt to download adware programs from various web servers. When the Trojan is first run, it will launch Internet Explorer to the sex site 'amateur.freespace.com' where it will then retrieve files based on a hacked web page. The web page directs the browser to retrieve the file 'tommy.exe' from 'omgtommy.server.us', among other files. The Trojan will persistently attempt to open the sex web sites periodically.


Recommended Action

  • Check the main screen using the web interface for your FortiGate unit to ensure that the latest AV/NIDS database has been downloaded and installed on your system - if required, enable the "Allow Push Update" option
  • Using the FortiGate manager, create a service named "RBOT.FL" and assign it to TCP port 30108. Enable blocking of this service for External to Internal communication