In this blog post I’ll examine a botnet attack utilizing Instant Messaging services such as AIM and Live Messenger to recruit infected computers. This botnet spreads a malicious Sdbot variant with a low detection rate; the following is a detailed technical analysis of this bot.

The Attack Vector
The Trojan itself arrives through MSN Messenger as a message with a link sent out by contacts with infected systems. Here is an example of a sent message:

Once the user clicks on the link, an executable will be downloaded into the user’s system. However, for launching the executable, the user must run it manually.

The downloaded executable is a Win32 Cabinet Self-Extractor given a name which makes it appear like an image file: IMG000985215488524-JPEG.EXE.

This Trojan has a very low detection rate according to VirusTotal. Up to the time of writing, only 7 out of 40 AV products detect this bot.

The Cabinet Self-Extractor file drops a file named d.exe, which has another packed PE file in its resource section (the file is packed with some private packer).

The decoding routine

The decoding routine of the bot (part 1).

The decoding routine of the bot (part 2).

The decoding routine of the bot (part 3).

Now, to get the new executable, we can simply dump the memory into a file and using a HexEditor, we cut the junk data from the beginning of the dump file:  

And using a tool such as Stud_PE to cut off the extra data at the end of the dump file:

Now we have the real Trojan. In a quick glance, we can clearly see it is an IRC bot and to be more accurate, it’s an SdBot which connects to an IRC server and joins a channel waiting for further commands from its operators.

The detection rate in VirusTotal gets better now, where 21 out of 40 detect this bot:

The following are the commands used by this botnet:
login || l
logout || lo
rm
download
update
gone || rmzerm3b1tch
threads || t
r.getfile
r.new
r.update || r.upd4te
msn.msg
msn.stop
aim.msg
aim.stop
trion.msg
trion.stop

Inspecting into the strings list of the new executable, we can see that the bot’s multiple functionalities include:
- Download and execute remote files
- Registry manipulation
- Services manipulation
- Opening sockets, including sending and receiving data through sockets
- Sending/Downloading data through HTTP
- Uploading/Downloading files through FTP
- DNS manipulation
- Open ports in the infected systems and hide those ports
- Retrieve TCP, UDP listener tables
- Retrieve MIB-II interface table
- Retrieve IP-to-physical address mapping table
- Add/Remove Network Connections
- Keylogging
- ARP table manipulation
- ODBC functionalities