Threat Description

Rizo

Details

Aliases:Rizo
Category:Malware
Type:Net-Worm, Backdoor
Platform:W32

Summary



Rizo is a family of IRC bot-based backdoors with network worm capabilities.



Removal


Automatic action

Once detected, the F-Secure security product will automatically disinfect the suspect file by either deleting it or renaming it.

More

You may wish to refer to the Support Community for further assistance. You also may also refer to General Removal Instructions for a general guide on alternative disinfection actions.

Disinfection of Network Worms

For a general guide on disinfectin a local network of a worm infections, see Eliminating a Local Network Outbreak.



Technical Details



Rizo malware can spread itself to remote computers with the help of an exploit. Unlike many other exploits that download a copy of malware from an already infected computer, Rizo's exploit downloads and runs a file from a website. Every time this website is accessed, a repacked variant is offered for download.

Rizo is a backdoor-worm that spreads within local networks and via the Internet. When it arrives on an infected computer it copies itself to the Windows System folder with the name ofwinlogin32.exe and creates several startup strings in the Registry:

  • [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]cpanel=%winsysdir%\winlogin32.exe
  • [HKLM\Software\Microsoft\Windows\CurrentVersion\Run]cpanel=%winsysdir%\winlogin32.exe

Being active, the backdoor connects to the following IRC servers:

  • ircc.debelizombi.com
  • xv21.debelizombi.com

Then the malware joins an IRC channel named #!v21! using the password 'tn10a4' without quotes. The port for connection is 8008.

The Rizo backdoor-worm can do any of the following:

  • Download and run files
  • Scan for vulnerable computers and spread to them
  • List and terminate processes
  • Join and part IRC channels, change nicks, change server
  • Send current IP address to a hacker
  • Report bot uptime to a hacker
  • Create remote command shell
  • Delete files
  • 'Call home' by accessing the dl1.debelizombi.com website

The URL above can be also used to upgrade the copy of the backdoor. At the moment the page contains only the text string 'EMPTY'.

The exploit in the backdoor's body is partially encrypted. When sent over to a target computer, the exploit decrypts itself (simple XOR 0x99 operation), resolves several APIs, downloads a file to the Windows System folder from the dl1.debelizombi.com website and runs it. The name of the downloaded file is a.exe.



Detection


F-Secure Anti-Virus detects this malware with the following updates:
Detection Type: PC
Database: 2006-10-18_10




SUBMIT A SAMPLE

Suspect a file or URL was wrongly detected? Submit a sample to our Labs for analysis

Submit Now

Give And Get Advice

Give advice. Get advice. Share the knowledge on our free discussion forum.

Learn More