When executed this worm installs its components into the
subdirectory zxz and/or zx in the Windows system directory and
registers its main file and the mIRC client in the Windows
registry auto-run key (below):
Randon then executes the above key and hides the process via the
HideWIndows utility. Randon connects to the IRC-server and
executes its scripts. In addition to DDoS attacks and IRC channel
flooding, Randon scans port 445 of other IRC clients.
Upon detection of an open port (445) the worm runs the batch
files sencs.bat and incs.bat which try to locate open resources
on the remote computer and connect to them using one of the
"admin", "administrator", "root", "admin", "test", "test123", "temp",
"temp123", "pass", "password", "changeme"
If a connection is successful the worm opens a socket on port
445, transfers the trojan horse TrojanDownloader.WIn32.APher.gen
and runs it. This trojan downloads a self-extracting archive of
the worm's 'full' version from "www.q8kiss.net" and installs it
in the system.
The Randon worm consists of the following components:
Deta.exe - HideWindows utility (WIn32 exe file)
fControl.a - an IRC script (port scanning and infection remote computers)
IfCOntrol.a - an IRC script (IRC-channels flooding and DDoS attacks (pinging different addresses) )
incs.bat - BATCH file (lan resources password cracker)
Libparse.exe is "PrcView" utility (Win32 EXE file)
psexec.exe is "PsExec" utility (Win32 EXE file)
rcfg.ini - IRC INI file (loading other scripts)
rconnect.conf - configuration file
reader.w - list of nicknames used by worm to establish connection with IRC-channels
Sa.exe - TrojanDOwnloader.Win32.Apher
scontrol.a - helper IRC script.
sencs.bat - BAT file (this file is transfered to the remote computer to perform TrojanDownloader execution)
systrey.exe - renamed mIRC client (Wind32 EXE file).
F-Secure Anti-Virus detects all Randon conmponents as:
Backdoor.IRC.mIRC-based, Backdoor.ServU-based, virus dropper,
security risk or a "backdoor", BAT/Ircmkac.setup.A,
IRC/Q8.backdoor.A, BAT/Q8.backdoor.A, IRC/Mkap.component.
[Kaspersky Lab and F-Secure Corp.; March 4th, 2003]