C’mon. This is proof I’d do really well working at Symantec, you know? Read more of this post to see how I reverse engineered the bot in under 30 minutes.

To Clean

1. Boot Windows into safe mode and do not run anything.
2. Carefully go into “C:\Windows” and remove the “tmpie” folder which contains the payload.
3. Optionally remove the registry key “HKLM,”Software\Microsoft\Windows\CurrentVersion\Run”,”iexplorer”,0,”%10%\tmpie\iexplorer.exe”"
4. Reboot into normal mode.
5. Change AIM password as well as all social networking passwords.
6. Stop downloading shit like this. Check to make sure the domain is real before you click. Yep, take a second or two to actually look at the URL bar in your browser. Won’t hurt you.

Detective Work

The bot is pretty straight forward with one new feature I’ve never personally seen before; it doesn’t use IRC. You execute the payload, it creates a registry key to start its self up on each boot, hooks a few programs to capture usernames and passwords, and at a set interval IMs all your buddies with the following message:

Did you see this yet? you have to download the flash thing for it to work http://www.liveleak.com.a.llli.**/?video=XqJ8CIaZiEXqJ8CIaZiE

Some victims report variations of the above message that use YouTube and other video sharing websites as lure. All use subdomains of llli.** (The TLD is an abbreviation of a country. WARNING: If you do go have a look for yourself, use caution. Do not execute anything. )

Nice little social engineering there. The page looks very realistic and potential victims of the worm are used to getting that “Update Your Flash Player” notification, so it seems only natural to run the payload. I award a 9/10 for the payload deceptiveness of this one.

First off, let’s start with the domain. A quick WHOIS query shows us some information about the owner of it:

Domain Name:                                 LLLI.**
Domain ID:                                   D18235149-US
Sponsoring Registrar:                        ENOM, INC.
Registrar URL (registration services):       whois.enom.com
Domain Status:                               clientTransferProhibited
Registrant ID:                               C5795F921E0
Registrant Name:                             aaron  stevens
Registrant Organization:                     just1
Registrant Address1:                         156 belmont ave
Registrant City:                             belair
Registrant State/Province:                   CA
Registrant Postal Code:                      90210
Registrant Country:                          United States
Registrant Country Code:                     US
Registrant Phone Number:                     +1.8848828383
Registrant Email:                            lstalent1@aim.com
Registrant Application Purpose:              P1
Registrant Nexus Category:                   C11
Administrative Contact ID:                   C5795F921E0
Administrative Contact Name:                 aaron  stevens
Administrative Contact Organization:         just1
Administrative Contact Address1:             156 belmont ave
Administrative Contact City:                 belair
Administrative Contact State/Province:       CA
Administrative Contact Postal Code:          90210
Administrative Contact Country:              United States
Administrative Contact Country Code:         US
Administrative Contact Phone Number:         +1.8848828383
Administrative Contact Email:                lstalent1@aim.com
Administrative Application Purpose:          P1
Administrative Nexus Category:               C11
Billing Contact ID:                          C5795F921E0
Billing Contact Name:                        aaron  stevens
Billing Contact Organization:                just1
Billing Contact Address1:                    156 belmont ave
Billing Contact City:                        belair
Billing Contact State/Province:              CA
Billing Contact Postal Code:                 90210
Billing Contact Country:                     United States
Billing Contact Country Code:                US
Billing Contact Phone Number:                +1.8848828383
Billing Contact Email:                       lstalent1@aim.com
Billing Application Purpose:                 P1
Billing Nexus Category:                      C11
Technical Contact ID:                        C5795F921E0
Technical Contact Name:                      aaron  stevens
Technical Contact Organization:              just1
Technical Contact Address1:                  156 belmont ave
Technical Contact City:                      belair
Technical Contact State/Province:            CA
Technical Contact Postal Code:               90210
Technical Contact Country:                   United States
Technical Contact Country Code:              US
Technical Contact Phone Number:              +1.8848828383
Technical Contact Email:                     lstalent1@aim.com
Technical Application Purpose:               P1
Technical Nexus Category:                    C11
Name Server:                                 NS1.ANEWGIRLSBOX.COM
Name Server:                                 NS2.ANEWGIRLSBOX.COM
Created by Registrar:                        ENOM, INC.
Last Updated by Registrar:                   ENOM, INC.
Domain Registration Date:                    Thu Dec 11 22:13:08 GMT 2008
Domain Expiration Date:                      Thu Dec 10 23:59:59 GMT 2009
Domain Last Updated Date:                    Thu Dec 11 22:14:05 GMT 2008

>>>> Whois database was last updated on: Fri Dec 26 23:22:50 GMT 2008 <<<

Obviously all fake info, which is a violation of eNom’s terms of services. Their account will be terminated. Going to the domain alone urges the visitor to download the payload, so we can confirm that the owner of the domain is the person spreading the bot.

Technical Stuff

Upon “getting the latest Flash Player”, the victim actually downloads an archive with the payload inside. The archive is configured to automatically run it upon execution.

The archive is made up of the following contents:

• iexplorer1.exe (payload)
• msado25.tlb
• MSVBVM60.DLL
• MSWINSCK.OCX
• RICHTX32.OCX
• setup.inf
• urlmon.dll
• wbemdisp.tlb
• wininet.dll

All VB, ActiveX, and DLL.

The payload executable has a file description that reads “Product name: bot”. No surprise there. It was last modified on 10/12/2008 7:28 PM, which is most likely the creation time of the client.

Here we can see a “setup.inf”, which tells the archive how to install the contents. setup.inf includes:

[version]
signature=”$CHICAGO$”

; #### INSTALLER ####
[DefaultInstall]
CopyFiles=install.files
RegisterOCXs=RegDLL.register
AddReg=add-registry-section

[DestinationDirs]
install.files=10,”tmpie”

[install.files]
MSWINSCK.OCX
RICHTX32.OCX
MSVBVM60.DLL
wininet.dll
msado25.tlb
urlmon.dll
wbemdisp.tlb

[RegDLL.register]
“%10%\tmpie\MSWINSCK.OCX”
“%10%\tmpie\RICHTX32.OCX”
“%10%\tmpie\MSVBVM60.DLL”
“%10%\tmpie\msado25.tlb”
“%10%\tmpie\wininet.dll”
“%10%\tmpie\urlmon.dll”
“%10%\tmpie\wbemdisp.tlb”

[add-registry-section]
HKLM,”Software\Microsoft\Windows\CurrentVersion\Run”,”iexplorer”,0,”%10%\tmpie\iexplorer.exe”

This explains its self quite well. The %10% variable equals your system folder. Everything gets stored in the “tmpie” folder and “iexplorer.exe” gets run on every boot. This too is quite deceptive, as iexplorer.exe looks like a legit Windows system file. Props.

The payload includes comments that reference a “Larry”. Perhaps Larry is the writer of this bot? Again, props my main man! We can also decompile his payload, since it’s written in VB.

Symptoms

It’s probably based off of someone else’s work. The bot seems to have been written in VB and uses a commercial DLL file to hook into AIM and Internet Explorer. This, in return, allows the bot to sniff for AIM, Facebook, MySpace, Frienster, and other website credentials, and of course forces the victim to send IMs with a link to the payload. Victims may also experience additional IE pop-ups with revenue-generating ads.

Calling Home

As for control over the botnet, PHP seems to be used and every set interval the bot will call home via an HTTP GET to “http://easyprofiles.****/login.php”. Neat, huh? No more messy IRC nets. Just a website.

Another WHOIS query of easyprofiles.**** gives us:

Domain ID:D19901248-LRMS
Domain Name:EASYPROFILES.INFO
Created On:15-Sep-2007 19:19:24 UTC
Last Updated On:03-Sep-2008 05:07:51 UTC
Expiration Date:15-Sep-2009 19:19:24 UTC
Sponsoring Registrar:eNom, Inc. (R126-LRMS)
Status:OK
Registrant ID:8FFBFEAEF102D2EE
Registrant Name:aaron stevens
Registrant Organization:just1
Registrant Street1:156 belmont ave
Registrant Street2:
Registrant Street3:
Registrant City:belair
Registrant State/Province:ca
Registrant Postal Code:90210
Registrant Country:US
Registrant Phone:+1.8848828383
Registrant Phone Ext.:
Registrant FAX:
Registrant FAX Ext.:
Registrant Email:lstalent1@aim.com
Admin ID:8FFBFEAEF102D2EE
Admin Name:aaron stevens
Admin Organization:just1
Admin Street1:156 belmont ave
Admin Street2:
Admin Street3:
Admin City:belair
Admin State/Province:ca
Admin Postal Code:90210
Admin Country:US
Admin Phone:+1.8848828383
Admin Phone Ext.:
Admin FAX:
Admin FAX Ext.:
Admin Email:lstalent1@aim.com
Billing ID:8FFBFEAEF102D2EE
Billing Name:aaron stevens
Billing Organization:just1
Billing Street1:156 belmont ave
Billing Street2:
Billing Street3:
Billing City:belair
Billing State/Province:ca
Billing Postal Code:90210
Billing Country:US
Billing Phone:+1.8848828383
Billing Phone Ext.:
Billing FAX:
Billing FAX Ext.:
Billing Email:lstalent1@aim.com
Tech ID:8FFBFEAEF102D2EE
Tech Name:aaron stevens
Tech Organization:just1
Tech Street1:156 belmont ave
Tech Street2:
Tech Street3:
Tech City:belair
Tech State/Province:ca
Tech Postal Code:90210
Tech Country:US
Tech Phone:+1.8848828383
Tech Phone Ext.:
Tech FAX:
Tech FAX Ext.:
Tech Email:lstalent1@aim.com
Name Server:NS1.ANEWGIRLSBOX.COM
Name Server:NS2.ANEWGIRLSBOX.COM
Name Server:
Name Server:
Name Server:
Name Server:
Name Server:
Name Server:
Name Server:
Name Server:
Name Server:
Name Server:
Name Server:

Looks familiar, no?

If it is in our nature to embrace technology and grow, yet it is also our nature as human beings to return to humanity and thus further humanizing our life, where do we find balence?

I often get a sickening feeling in my stomach when I think about humans becoming technology, and technology becoming humans. It is a scary and almost taboo topic in its nature. Yet I still work with computers on a daily basis and I still use technology to better my life experience; my relationships, my work, my seeking of knowledge. This leaves me in a state of confusion, as if I can not even begin to comprehend this matter at all.

Where do you find balence?

Let us use our powers of influence to better the world.

Differences

We were all born with different genetic codes that determined our eye color, hair color, skin color, size, and countless other features.

We are of different backgrounds, which gives us our culture.

We speak different languages, which determines who we can or can’t communicate with.

We are exposed to different hardships, which leaves us with different struggles.

We grew up with different parents, who passed down their rituals to us.

We grew up with different friends who gave us our childhood memories.

We have different positions in society, each giving us a specific role.

We have different passions, leaving us with expectations of what we want life to mean and be for us.

We have different hobbies, which determine what we do with our free time.

We have different strengths and weaknesses, which gives us our abilities to do things well and others not.

We have different opinions, which can cause great arguments and void of understanding.

We have different preferences of our ideal partner, which determine who we will seek for in life.

We have different needs, which cause us to seek after different resources.

We have different focuses, which determine what we will pay great thought to and others not.

We have differences.

Yet we can still experience beautiful, long-lasting relationships

And communicate endlessly with others,

Excellently.

There seems to be a piece of the human nature code that causes us to keep exploring, expanding, building, and tearing down. This would seem  economically, socially, and evolutionarily sound, and this is especially so if we look at what history has to show us about the development of the human species. However, we’re entering an age where the amount of information available to us is truly overwhelming.

How the hell do we keep up? Seriously, how? Almost everyday there’s a new software, a new development, a new tech. start-up, a new product, a new change. Trying to crunch everything into our brains simply isn’t efficient. And for many of us, all this information interferes with our goals. It’s just too overwhelming. Where do we go next? What area do we seek next in life? Where is the next potential of success hiding?

As life gets more complicated because of the information we’re producing more and more of, I think it is our jobs as human beings to stay increasingly simple in our nature. I don’t mean to tell you to push away the latest technological advancements; this would be impractical and very harmful to our success. What I am getting at here is keeping our focus simple. Really ask your self “what do I want from this world?” and “how do I get it?” The world has a lot to offer and you need to be able to sort through all the noise to get to it.

Success, to many, is simply meeting our goals. It’s having some sort of concept of what we want to do with our time and efforts and getting an outcome that makes us happy. Yet time and time again, we don’t reach our goals and we’re left with a feeling of unaccomplishment; of complete and total failure.

Here’s how I break down success.

1. Knowing what you want

This is probably the toughest part of success. You can’t accomplish something and obtain success in anything unless you have something to obtain that isn’t in your posession. This is a circumstance that you’ve become consciously aware of that you wish to change. To change this circumstance we, as human beings, use our conscious and unconscious mind to guide our actions. Through our actions, be it communication or physical acts of exertion, we influence the world around us how we like hoping to get what we like returned. This should be stated positively; that is, what one wants to happen rather then does not want to happen. This is because the mind at it’s lowest fundamental levels does not understand negative commands.

2. Knowing when you’ve got it

This is the second hardest and most crucial part of success; knowing when you’ve got it. Many people set their goals and achieve what they had in mind. Yet over time, their goals may change or they may never even realize they’ve met their goals. This, then, involves the art of acute sensory. One must take careful detail of what sensory input they are obtaining and link it back to the goal they are tackling, always asking “what have I got?” and “what are my goals?”

3. Having the ability to change until you’ve got it

This is the last step of the success equation. It involves being flexible and accepting the fact that you may need to try many times to get what you want. Only once this truth is accepted can one keep trying with the same or even greater motivation that existed in the beginning. In fact, this here is a key motivational strategy. If it is not, every single one of us will eventually feel the emotional impact of what we call “failure”. So then, remember that this “failure” is nothing more then the very sensory input we talked about in step 2. One must then take a step back from the problem at hand, recollect the thoughts, and set out again cycling through steps 2 and 3 until success is obtained.

Working with this break down of success, one can achieve anything. This is especially relavent in our world, where as both technological and human networking develops so does our ability to obtain the resources we need to succeed.

I’m actually going to keep the little default post that WordPress throws in there. Why do they do they include it in default installations? It always gets deleted… Until now.

Anyhow, if you want to know more about me check out the “About Me” page. I’m basically the hybrid of a kid who grew up always wondering how shit worked and a well-rounded, pretty average guy residing in New York City who enjoys sports and people.

Happy holidays everybody!