Content
Spam-Mailbot.m
- Type
- Trojan
- SubType
- Spam
- Discovery Date
- 04/22/2009
- Length
- Varies
- Minimum DAT
- 5592 (04/22/2009)
- Updated DAT
- 6260 (02/17/2011)
- Minimum Engine
- 5.2.00
- Description Added
- 04/22/2009
- Description Modified
- 06/01/2009 12:31 PM (PT)
Risk Assessment
- Corporate User
- Low-Profiled
- Home User
- Low-Profiled
Tab Navigation
Characteristics
Spam-Mailbot.m is a family of trojans used to send spam. When run, the file copies itself as %windir%\servises.exe and sets it as an allowed program in the Windows firewall:
The following file(s) have been added to the system:
- %WINDIR%\system32\servises.exe
- %WINDIR%\system32\sdra64.exe
- %WINDIR%\system32\lowsec\user.ds
- %WINDIR%\system32\lowsec\local.ds
- %WINDIR%\Temp\3.tmp
Note:
%WinDir% refers to Windows installation folder (Windows 9x/ME/XP/Vista)
The following registry element(s) have been created:
- HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\{19127AD2-394B-70F5-C650-B97867BAA1F7}
- HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\{43BF8CD1-C5D5-2230-7BB2-98F22C2B7DC6}
- HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\{EAB536DF-0DAB-5F86-EB7D-D060B52E9606}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
- "Userinit" = C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\sdra64.exe,
HKEY_CURRENT_USER\Software\Microsoft\Windows\currentversion\policies\explorer\run\
- servises = c:\windows\system32\servises.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\currentversion\policies\explorer\run\
- servises = c:\windows\system32\servises.exe
Trojan uses following registry key to store its configuration data:
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop
- id = "104214710971"
- host = "127.0.0.1"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
- FirewallOverride = 0x00000001
Trojan contains functionality to send out email message(s) with the built-in SMTP client engine. It attempts to connect to the following servers for additional instructions:
- 66.96.248.21
- 91.207.7.234
- 91.207.5.66
- 206.51.234.126
- 206.137.17.89
- 209.20.130.33
- [blocked].theplanet.com
Symptoms
This symptoms of this detection are the files, registry, and network communication referenced in the characteristics section.
Method of Infection
Trojans do not self-replicate. They are spread manually, often under the premise that the executable is something beneficial. Distribution channels include IRC, peer-to-peer networks, newsgroup postings, e-mail, etc.
Removal
All Users:
Use current engine and DAT files for detection and removal.
Modifications made to the system Registry and/or INI files for the purposes of hooking system startup, will be successfully removed if cleaning with the recommended engine and DAT combination (or higher).
Variants
Variants
N/A
All Information
Overview -
-- Update June 1, 2009 --
The risk assessment of this threat has been updated to Low-Profiled due to media attention at:
http://isc.sans.org/diary.html?storyid=6499
--
This is a Trojan detection. Unlike viruses, Trojans do not self-replicate. They are spread manually, often under the premise that they are beneficial or wanted. The most common installation methods involve system or security exploitation, and unsuspecting users manually executing unknown programs. Distribution channels include e-mail, malicious or hacked Web pages, Internet Relay Chat (IRC), peer-to-peer networks, etc.
Aliases
- Email-Worm.Win32.Joleee.adq(Kaspersky)
- Mal/WaledPak-A(Sophos)
- Spammer:Win32/Tedroo.I(Microsoft)
- Win32:TedoBot (Avast)
Characteristics
Characteristics -
Spam-Mailbot.m is a family of trojans used to send spam. When run, the file copies itself as %windir%\servises.exe and sets it as an allowed program in the Windows firewall:
The following file(s) have been added to the system:
- %WINDIR%\system32\servises.exe
- %WINDIR%\system32\sdra64.exe
- %WINDIR%\system32\lowsec\user.ds
- %WINDIR%\system32\lowsec\local.ds
- %WINDIR%\Temp\3.tmp
Note:
%WinDir% refers to Windows installation folder (Windows 9x/ME/XP/Vista)
The following registry element(s) have been created:
- HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\{19127AD2-394B-70F5-C650-B97867BAA1F7}
- HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\{43BF8CD1-C5D5-2230-7BB2-98F22C2B7DC6}
- HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\{EAB536DF-0DAB-5F86-EB7D-D060B52E9606}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
- "Userinit" = C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\sdra64.exe,
HKEY_CURRENT_USER\Software\Microsoft\Windows\currentversion\policies\explorer\run\
- servises = c:\windows\system32\servises.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\currentversion\policies\explorer\run\
- servises = c:\windows\system32\servises.exe
Trojan uses following registry key to store its configuration data:
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop
- id = "104214710971"
- host = "127.0.0.1"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
- FirewallOverride = 0x00000001
Trojan contains functionality to send out email message(s) with the built-in SMTP client engine. It attempts to connect to the following servers for additional instructions:
- 66.96.248.21
- 91.207.7.234
- 91.207.5.66
- 206.51.234.126
- 206.137.17.89
- 209.20.130.33
- [blocked].theplanet.com
Symptoms
Symptoms -
This symptoms of this detection are the files, registry, and network communication referenced in the characteristics section.
Method of Infection
Method of Infection -
Trojans do not self-replicate. They are spread manually, often under the premise that the executable is something beneficial. Distribution channels include IRC, peer-to-peer networks, newsgroup postings, e-mail, etc.
Removal -
Removal -
All Users:
Use current engine and DAT files for detection and removal.
Modifications made to the system Registry and/or INI files for the purposes of hooking system startup, will be successfully removed if cleaning with the recommended engine and DAT combination (or higher).
Variants
Variants -
N/A