THE HISTORY OF THE DARKSEOUL GROUP AND THE SONY INTRUSION MALWARE DESTOVER

KORDLLBOT-RELATED SMB WORMS
The malware samples 163571bd56001963c4dcb0650bb17fa23ba23a5237c21f2401f4e894dfe4f50d and
e0cd4eb8108dab716f3c2e94e6c0079051bfe9c7c2ed4fcbfdd16b4dd1c18d4d in the cluster of signed malware do
not look like KorDllbots at first glance.
The usual service DLL dropper is here replaced with a worm component. After installation and reboot, this worm
generates random IP addresses and attempts to connect to the admin$ share on remote machines using the hard
coded usernames “administrator” and “db2admin”. The malware contains a list of common passwords and it will
also construct passwords based on the username. If successful, the worm copies itself to the remote machine’s
system directory and installs it as a service there.
In addition to spreading, these samples drop a backdoor component which is somewhat different in structure to
the “standard” KorDllbots. The dropper code logic used in these worms is however used in other KorDllbot dropper
samples and is unmistakable - the strings “DGTSIGN” and “www.goog1e.cn” are markers which the malware uses
to locate its embedded content.
9bc8fe605a4ad852894801271efd771da688d707b
9fbe208106917a0796bbfdc
This is a KorDllbot dropper
e0cd4eb8108dab716f3c2e94e6c0079051bfe9c7c
2ed4fcbfdd16b4dd1c18d4d
This is an SMB worm