Venus AUEB Forum

Code: Select all

Upon execution on the victim machine, the worm installs itself as JAVA.EXE in the Windows directory. For example:

    * C:\WINDOWS\JAVA.EXE

It also drops the file SERVICES.EXE into this directory:

    * C:\WINDOWS\SERVICES.EXE

The following Registry keys are added to hook system startup:

    * HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
      \Run "JavaVM" = %WinDir%\JAVA.EXE
    * HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
      \Run "Services" = %WinDir%\SERVICES.EXE

The following Registry keys are also added:

    *  HKEY_CURRENT_USER\Software\Microsoft\Daemon
    *  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Daemon

TCP Port 1034 is opened on the victim machine by the SERVICES.EXE process and listens for incoming connections. This process also sends TCP network traffic from a highport of the infected machine, to randomly generated IP addresses on destination Port 1034.  When another IP address is found to be infected with the backdoor, the IP address of that machine is encrypted and written to a file named zincite.log.