W32/RBot.EP!worm
Analysis
Specifics
This is a network-aware Internet worm which spreads
from system to system using Netbios TCP port 139. The
virus attempts to copy itself to these shares -
C$
D$
IPC$
ADMIN$
Loading At Windows Startup
If the virus can successfully copy itself to any of
these shares, it will then attempt to launch the copied
virus. When the virus runs, it will register itself
to auto-run at Windows startup.
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\
Microsoft Updating = wuamgrd.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\
Microsoft Updating = wuamgrd.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices\
Microsoft Updating = wuamgrd.exe
IRC Connection
The virus may attempt to connect with an IRC server
using TCP port 6667. Once connected the virus can receive
commands which could instruct the virus to extract certain
registry keys related to PC game programs, scan for
vulnerable systems or other actions.
Recommended Action
- Check the main screen using the web interface for
your FortiGate unit to ensure that the latest AV/NIDS
database has been downloaded and installed on your
system - if required, enable the "Allow Push
Update" option
- Using the FortiGate manager, block external to internal access using TCP ports 139
Telemetry
Detection Availability
FortiClient | |
---|---|
Extreme | |
FortiMail | |
Extreme | |
FortiSandbox | |
Extreme | |
FortiWeb | |
Extreme | |
Web Application Firewall | |
Extreme | |
FortiIsolator | |
Extreme | |
FortiDeceptor | |
Extreme | |
FortiEDR |