SANs does a great analysis of the LEAVE WORM

Over the weekend we have been working to analyze a new MS Windows worm named W32.leave.worm. Although the ultimate intent of this worm has not yet been discovered, there are indications that it may be used as part of Zombie DDoS agents.

Network traffic collected by the Internet Storm Center and its partners indicates that there is widespread activity. It is assumed that the worms ability to synchronize the system time, to download additional code, and to listen to IRC channels make it a very dangerous DDOS tool.

DESCRIPTION
This program propagates itself via connections to Sub7 port 27374. It then issues the
default Sub7 password, and if successful, tells the computer to download and execute f.exe
from l4l4l4l4.spites.com (which has been shutdown). After executing, it does several
things:

Upon startup, f.exe looks for C:WINDOWSin.dll, C:WINDOWS
egsv.exe, and
C:WINDOWSaci3.dll (not found) and deletes these files if found.

It then creates its own copies of regsv.exe and acl3.dll.

Then regsv.exe is launched by f.exe, which deletes f.exe. A registry value is
created to run regsv.exe as a "service" via
HKLMSoftwareMicrosoftWindowsCurrentVersionRunServices.

regsv.exe opens and closes C:WINDOWSWIN.INI, but no modification of the file was shown.

The trojan attempts resolving hostnames to:

altavista.com
yahoo.com
excite.com
goto.com

to presumably determine whether the infected system is connected to the Internet.

It then attempts to connect to the tick.UH.EDU and several site at 50megs.com.
When it is not able to connect to tick.uh.eud, it attempts to connect first to
ntp2.usno.navy.mil and then ntp0.NL.net

Once the time syncronization is complete, it attempts to connect to l4l4l4l4.spites.com to
download a dll file. Upon a successful download, it uses ntp2.usno.navy.mil to retrieve
the proper date and time via daytime (TCP 13).

Finally, it starts scanning port 27374 within predetermined netblocks associated with
@Home and Earthlink. It also connects to IRC, creates a random name, and connects to a
predetermined channel and waits.

DETECTION
Since the subsequent malicous activity is scanning tcp port 27374, your IDS sensors should
be able to detect this traffic as a sub7 scan.

Snort will pick up the probes to 27374.

http://www.whitehats.com/cgi/arachNIDS/Show?_id=ids279&view=signatures

http://www.snort.org/Files/Current/backdoor.rules

You can run nmap against your network looking for an open tcp 27374 port open.

Symantec, McAfee and Trend Antivirus included relevant file signature in recent .dat file
updates to detect if a system is infected.

http://www.symantec.com/avcenter/venc/data/w32.leave.worm.html

http://vil.nai.com/vil/dispVirus.asp?virus_k=99115

http://www.antivirus.com/vinfo/virusencyclo/default5.asp?VName=TROJ_LEAVE.A

PROTECTION
The worm requires the target system to be infected with Sub7. Most virus scanners will
detect Sub7 and remove it.

You should employ egress filtering and completely block inbound/outbound TCP 27374. You
can also look for outbound activity to TCP 80 (l4l4l4l4.spites.com) and outbound TCP 80
(*.50megs.com (208.185.127.162)) and also outbound TCP 6667 IRC connections.

Use an antivirus product on your system and keep it current. Also employ a personal
firewall such as http://www.zonealarm.com/ ZoneAlarm or
http://www.symantec.com/product/home-is.html Norton Personal Firewall.

REMOVAL
At this time, removal is difficult. It places hooks in many files, and when you try to
replace these files, it reinfects them.

Antivirus vendors have developed a way to clean your system of these files. Please check
your AV vendors site for specific removal instructions.

REFERENCES
http://www.incidents.org
http://www.symantec.com/avcenter/venc/data/w32.leave.worm.html
http://vil.nai.com/vil/dispVirus.asp?virus_k=99115
http://www.nipc.gov/warnings/advisories/2001/01-014.htm

TIMELINE
6-19-01 Lawrence Baldwin of myNetWatchman (http://www.mynetwatchman.com)
seen an increase in probes to his agents. He contacted Incidents.org handlers and we set
out the best way to approach this. Initial thoughts was maybe a spoofed DDoS attack
against AOL.

6-20-01 Lawrence had his agents capture network traces of the probes and contacted several
infected users. This confirmed that this was more likely a worm, and not a spoofed DDoS
attack.

6-21-01 Johannes Ullrich SANS Institute, setup a honeypot, in order to dig deeper into
what was happening with the probes. He found that after authentication, the attacking
computer told us to goto l4l4l4l4.spites.com and download f.exe
f.exe was sent to Lenny Zeltser for file analysis and debugging. Lenny
provided the description above after running it in his lab.
Due to the possible implications with this, contact was made with Law
Enforcement for cooperation in this event.

6-22-01 Due to the complexity of the code. Law Enforcement and AV vendors began working
steadily on trying to disect this code further.

CREDITS
This security advisory was prepared by Matt Fearnow of the SANS Institute. Thorough
analysis was performed by Lenny Zeltser and NIPC Labs.

Also contributing efforts goto Johannes Ullrich of the SANS Institute, Lawrence Baldwin of
myNetWatchman.

MIRROR
This write up can be found at:
http://www.incidents.org/react/w32leaveworm.php