W32/Randex.C
Analysis
- Virus is 32bit with a compressed size of 40,960
bytes and a file date of June 10, 2003
- Virus uses imports from MPR.DLL to enumerate network
connections and attempt to connect with them in an
effort to spread to that system – virus is also
related to Backdoor.Sdbot in some aspects
- Virus may exist as the file GESFM32.EXE or MSMONK32.EXE
in the Windows\System folder on an infected machine
- If the virus is activated, it will run memory resident
and copy itself to the Windows\System folder and modify
the registry to load at Windows startup –
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\
Microsoft Netview = gesfm32.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices\
Microsoft Netview = gesfm32.exe
- The virus will then attempt to search for machines
on the local area network and attempt to connect with
them using a dictionary attack method, then write
a copy of itself to that machine into the System folder
and initiate execution of the file remotely
- Virus will also attempt to scan IP addresses in
an attempt to identify if they are using file share
and attempt to infect that target
- If viable targets are located, virus will attempt
to copy itself to the c$\System32 or Admin$\System32
share as msmonk32.exe then issue a remote instruction
to run the file
- Virus attempts to connect to the IP address 217.211.72.145
persistently
- Virus also serves as an IRC bot allowing a hacker
or group of hackers to issue commands such as sending
messages or issuing SYN floods
- Virus contains the string “monk.10 420420”
in its compressed body