Classification

Category: Malware

Type: -

Aliases: Petala, Backdoor.Petala

Summary


Petala backdoor (hacker's remote tool) was first found on 28th of September 2003. The backdoor provides a limited access to an infected system for remote hackers. The backdoor originate from Brasil.

Removal


Automatic action

Based on the settings of your F-Secure security product, it will either automatically delete, quarantine or rename the detected program or file, or ask you for a desired action.

Knowledge Base

Find the latest advice in our Community Knowledge Base.

About the product

See the manual for your F-Secure product on the Help Center.

Contact Support

Chat with or call an expert for help.

Submit a sample

Submit a file or URL for further analysis.

Technical Details


The backdoor is written in Visual Basic. Its file is 331 kilobytes long and has VB P-Code instead of normal Assembly instructions.

Techical details

When the backdoor's file is run, it installs itself to system. The backdoor copies itself to Windows folder as WINDATA.EXE file and to Windows System folder as MSJIS.EXE file. The backdoor creates startup keys for both these files in System Registry:

[HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN]
"Microsoft Network Registry Control" = "%windir%\system\msjis.exe"
[HKEY_USERS\S-1-5-21-484763869-746137067-854245398-1003\Software\Microsoft\Windows\CurrentVersion\Run]
"Environ Monitor" = "%windir%\system\msjis.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN]
"Microsoft Network Control" = "%windir%\windata.exe"
[HKEY_USERS\S-1-5-21-484763869-746137067-854245398-1003\Software\Microsoft\Windows NT\CurrentVersion\Windows\Run]
@ = "%windir%\windata.exe"

The backdoor can also modify WIN.INI file to make its files start during every Windows session.

The backdoor can create the following files in Windows folder:

msjet.sys
navrs.sys
regbck.sys

The backdoor replaces SCRIPT.INI file of mIRC client with its own one. The new file instructs an IRC client to send the following message to all users joining a channel where an infected person is present:

Tranforme seu WINDOWS numa super estacao de trabalho interligada
24h na internet com os melhores servicos gr¡tis. Desde
televis£o, cinema, ate jogos e supermercado, locadora, acougue,
farm¡cia de todo brasil. Algo realmente nunca visto antes. E
tudo com um simples update e com a garantia da microsoft.
Confira:

We believe that the backdoor's author wanted the backdoor to spread through IRC networks, but this functionality was not completed for some reason.

The backdoor can be controlled using an IRC bot. Additionally the backdoor has a built-in FTP server and mail relay. A hacker can do the following actions using the backdoor:

Login to backdoor
Change bot's nick
Join or part a channel
Send text message
Set channel mode
Start file
Delete file
Copy file
Send SPAM
Change IDENT
Give or take voice (prefered user)
Give or take op (channel operator)
Ban or unban user
Ignore user
Uninstall backdoor
Send URL
Get process list
Kill specified process
List files on an infected hard drive
Start frp server
Payload

The backdoor kills the following files:

%windir%\menu iniciar\programas\iniciar\wd.exe
%windir%\Start Menu\Programs\StartUp\wd.exe
%sysdrv%\Documents And Settings\All Users\Menu Iniciar\Programas\Inicializar\wd.exe

where %sysdrv% is system drive and %windir% is Windows folder.

The backdoor deletes files and terminates processes with the following names:

vsmon.exe
minilog.exe
zapro.exe
avgserv.exe
symtray.exe
wingate.exe
persfw.exe
vsstat.exe
vshwin32.exe
webscan.exe
rulaunch.exe
mcshield.exe
wg2eng95.exe
nprotect.exe
avgserv9.exe
pstores.exe
avgcc32.exe
wg3eng9x.exe
navapw32.exe
wengmon.exe
cjinject.exe
ccevtmgr.exe
navapw32.exe
poproxy.exe
proxy.exe
csinsm32.exe
monwow.exe
cmgrdian.exe
avconsol.exe
avsynmgr.exe