Petala

The backdoor is written in Visual Basic. Its file is 331 kilobytes long and has VB P-Code instead of normal Assembly instructions.

Techical details

When the backdoor's file is run, it installs itself to system. The backdoor copies itself to Windows folder as WINDATA.EXE file and to Windows System folder as MSJIS.EXE file. The backdoor creates startup keys for both these files in System Registry:

[HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN] "Microsoft Network Registry Control" = "%windir%\system\msjis.exe" [HKEY_USERS\S-1-5-21-484763869-746137067-854245398-1003\Software\Microsoft\Windows\CurrentVersion\Run] "Environ Monitor" = "%windir%\system\msjis.exe" [HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN] "Microsoft Network Control" = "%windir%\windata.exe" [HKEY_USERS\S-1-5-21-484763869-746137067-854245398-1003\Software\Microsoft\Windows NT\CurrentVersion\Windows\Run] @ = "%windir%\windata.exe"

The backdoor can also modify WIN.INI file to make its files start during every Windows session.

The backdoor can create the following files in Windows folder:

msjet.sys navrs.sys regbck.sys

The backdoor replaces SCRIPT.INI file of mIRC client with its own one. The new file instructs an IRC client to send the following message to all users joining a channel where an infected person is present:

Tranforme seu WINDOWS numa super estacao de trabalho interligada 24h na internet com os melhores servicos gratis. Desde televis o, cinema, ate jogos e supermercado, locadora, acougue, farm cia de todo brasil. Algo realmente nunca visto antes. E tudo com um simples update e com a garantia da microsoft. Confira:

We believe that the backdoor's author wanted the backdoor to spread through IRC networks, but this functionality was not completed for some reason.

The backdoor can be controlled using an IRC bot. Additionally the backdoor has a built-in FTP server and mail relay. A hacker can do the following actions using the backdoor:

Login to backdoor Change bot's nick Join or part a channel Send text message Set channel mode Start file Delete file Copy file Send SPAM Change IDENT Give or take voice (prefered user) Give or take op (channel operator) Ban or unban user Ignore user Uninstall backdoor Send URL Get process list Kill specified process List files on an infected hard drive Start frp server

Payload

The backdoor kills the following files:

%windir%\menu iniciar\programas\iniciar\wd.exe %windir%\Start Menu\Programs\StartUp\wd.exe %sysdrv%\Documents And Settings\All Users\Menu Iniciar\Programas\Inicializar\wd.exe

where %sysdrv% is system drive and %windir% is Windows folder.

The backdoor deletes files and terminates processes with the following names:

vsmon.exe minilog.exe zapro.exe avgserv.exe symtray.exe wingate.exe persfw.exe vsstat.exe vshwin32.exe webscan.exe rulaunch.exe mcshield.exe wg2eng95.exe nprotect.exe avgserv9.exe pstores.exe avgcc32.exe wg3eng9x.exe navapw32.exe wengmon.exe cjinject.exe ccevtmgr.exe navapw32.exe poproxy.exe proxy.exe csinsm32.exe monwow.exe cmgrdian.exe avconsol.exe avsynmgr.exe