Name :	Backdoor:W32/Agent.ADQB
Detection Names :	backdoor.win32.agent.adqb
Aliases :	Backdoor.IRC.Bot (Symantec) W32/Sdbot.worm.gen.h (McAfee) Backdoor:Win32/IRCBot.gen!K (Microsoft)
Category:	Malware
Type:	Backdoor
Platform:	W32

A remote administration utility which bypasses normal security mechanisms to secretly control a program, computer or network.

This backdoor program attempts to connect to a remote IRC server. It also attempts a Denial-of-Service (DoS) exploit on any machines it finds with an open Microsoft-ds (Directory Service) port.


Installation

During installation, the following files are created:



Activity

While active, the backdoor attempts to connect to a remote IRC server:


The backdoor also iterates the IP address and looks for available systems with an open Microsoft-ds port (specifically, tcp 445).  If a vulnerable machine is discovered, the backdoor breaches the targeted machine's Windows Firewall, a form of Denial-of-Service (DoS) exploit similar to the notorious MS04-011 vulnerability.

To protect the backdoor, the WMISRV Service is stopped when the debugger program Ollydbg is launched; this protective action makes the debugging process more difficult.


Registry

The backdoor edits the Windows Firewall Policy, to allow it to function as an authorized application.


It also sets two malware launch points as services:



The following mutex name is used by wmisvr.exe: