F-Secure Virus Descriptions : Petala

[Summary] | [Detailed Description] | [Detection]

NAME:	Petala
ALIAS:	Backdoor.Petala

Summary

Petala backdoor (hacker's remote tool) was first found on 28th of September 2003. The backdoor provides a limited access to an infected system for remote hackers. The backdoor originate from Brasil.

Detailed Description

The backdoor is written in Visual Basic. Its file is 331 kilobytes long and has VB P-Code instead of normal Assembly instructions.

Techical details

When the backdoor's file is run, it installs itself to system. The backdoor copies itself to Windows folder as WINDATA.EXE file and to Windows System folder as MSJIS.EXE file. The backdoor creates startup keys for both these files in System Registry:

 [HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN]
 "Microsoft Network Registry Control" = "%windir%\system\msjis.exe"

 [HKEY_USERS\S-1-5-21-484763869-746137067-854245398-1003\Software\Microsoft\Windows\CurrentVersion\Run]
 "Environ Monitor" = "%windir%\system\msjis.exe"

 [HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN]
 "Microsoft Network Control" = "%windir%\windata.exe"

 [HKEY_USERS\S-1-5-21-484763869-746137067-854245398-1003\Software\Microsoft\Windows NT\CurrentVersion\Windows\Run]
 @ = "%windir%\windata.exe"

The backdoor can also modify WIN.INI file to make its files start during every Windows session.

The backdoor can create the following files in Windows folder:

 msjet.sys
 navrs.sys
 regbck.sys

The backdoor replaces SCRIPT.INI file of mIRC client with its own one. The new file instructs an IRC client to send the following message to all users joining a channel where an infected person is present:

 Tranforme seu WINDOWS numa super estacao de trabalho interligada
 24h na internet com os melhores serviços grátis. Desde
 televisão, cinema, até jogos e supermercado, locadora, açougue,
 farmácia de todo brasil. Algo realmente nunca visto antes. E
 tudo com um simples update e com a garantia da microsoft.
 Confira:

We believe that the backdoor's author wanted the backdoor to spread through IRC networks, but this functionality was not completed for some reason.

The backdoor can be controlled using an IRC bot. Additionally the backdoor has a built-in FTP server and mail relay. A hacker can do the following actions using the backdoor:

 Login to backdoor
 Change bot's nick
 Join or part a channel
 Send text message
 Set channel mode
 Start file
 Delete file
 Copy file
 Send SPAM
 Change IDENT
 Give or take voice (prefered user)
 Give or take op (channel operator)
 Ban or unban user
 Ignore user
 Uninstall backdoor
 Send URL
 Get process list
 Kill specified process
 List files on an infected hard drive
 Start frp server

Payload

The backdoor kills the following files:

 %windir%\menu iniciar\programas\iniciar\wd.exe
 %windir%\Start Menu\Programs\StartUp\wd.exe
 %sysdrv%\Documents And Settings\All Users\Menu Iniciar\Programas\Inicializar\wd.exe

where %sysdrv% is system drive and %windir% is Windows folder.

The backdoor deletes files and terminates processes with the following names:

 vsmon.exe
 minilog.exe
 zapro.exe
 avgserv.exe
 symtray.exe
 wingate.exe
 persfw.exe
 vsstat.exe
 vshwin32.exe
 webscan.exe
 rulaunch.exe
 mcshield.exe
 wg2eng95.exe
 nprotect.exe
 avgserv9.exe
 pstores.exe
 avgcc32.exe
 wg3eng9x.exe
 navapw32.exe
 wengmon.exe
 cjinject.exe
 ccevtmgr.exe
 navapw32.exe
 poproxy.exe
 proxy.exe
 csinsm32.exe
 monwow.exe
 cmgrdian.exe
 avconsol.exe
 avsynmgr.exe

Back to the Top

Detection

F-Secure Anti-Virus detects Petala with the update released on September 29th, 2003:

[FSAV_Database_Version]

Version=2003-09-29_02

Back to the Top

Technical Details: Alexey Podrezov

F-Secure Corporation; 29th of September, 2003