W32/Kassbot-B is a network worm with backdoor component.
W32/Kassbot-B will monitor a user's internet access. When certain internet banking and finance sites are accessed, the worm will redirect the user to a Russian website with fake login pages or email the stolen details to a Russian email address. The banking sites include the following:
Barclays
Halifax
HSBC
LloydsTSB
NatWest
W32/Kassbot-B will attempt to spread by exploiting the following vulnerabilities:
DCOM (MS04-012)
LSASS (MS04-011)
Unicode Directory Traversal exploit on Microsoft IIS Web servers
W32/Kassbot-B will connect to an IRC server and provide backdoor access to the infected computer.
W32/Kassbot-B will drop and load a DLL named MSRSDN32.DLL. This file is also detected as W32/Kassbot-B.
On Windows 95/98/ME, W32/Kassbot-B will set the following registry entry in order to run automatically each time a user logs in:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Network Host Controller
<path to worm>
On Windows NT-based systems (NT/2000/XP), W32/Kassbot-B will run itself as a service named "nethost" with a display name of "Network Host Controller" and a Startup type of automatic, so that the service is run automatically each time a new Windows session is started.
Registry entries will be created under the following branch:
HKLM\SYSTEM\CurrentControlSet\Services\nethost
W32/Kassbot-B will add the following registry entry:
HKLM\SYSTEM\CurrentControlSet\Services\RpcSs
DependOnService
nethost
The following URLs and browser title strings are scanned for:
A B C
Alpha Bank
Amarillo National Bank
American Gateway Bank
American Savings Bank
ATBOnline
Banamex.com
Banca Popolare di Bergamo
Banco de Reservas - Portal Financiero
Banco di Caribe Online
Banco Ita
Banespa
Bank Independent
Bank Midwest
Bank of the Cascades
Bank of the Orient
Banque
Banregio
Barclays International Online Banking - Login
Beneficial Home
Bienvenue sur La Poste.fr
Bradesco - Colocando voc
Bruceton Bank, Your Community Bank.
Busey Financial Services
Buy E Gold
Caisse d'Epargne, jeunes, associations, professionnels, entreprises, pme,
Cambist.net
Chase.com Home Page
Citibank Online - Sign On
Commerce Online
ESB Bill Pay
Farmers & Merchants Bank - Login
FirePay.com
First Bank of Newton
firststateks.com
frente
Hillcrest Bank
Home Banking
HSBC Internet Banking
http://davis-company.com
http://www.bankofindia.com
http://www.goldage.net
http://www.sabadellatlantico.com
https://banking.diba.de
https://billscenter.paytrust.com
https://ebanking.bgl.lu
https://etimebanker.bankofthewest.com
https://ibank.barclays.co.uk
https://leu.directnet.com
https://online.dollarbank.com
https://secure.americanfederal.net
https://secure.nationalinterbank.com
https://secure.regionsnet.com
https://svr1.instant-ecash.com
https://web7.evault.ws
https://www.amazon.com
https://www.bbvanet.cl
https://www.blcdirect.banquelaurentienne.ca
https://www.cashcards.net
https://www.e-gold.com
https://www.ebankinter.com
https://www.fiservdmecom1.net
https://www.fiservla3.com
https://www.goldpouchexpress.com
https://www.halifax-online.co.uk
https://www.icegold.com
https://www.loyalbank.com
https://www.ncrbanks.com
https://www.netteller.com
https://www.nwolb.com/secure
https://www.saradar.com
https://www.site-secure.com
https://www.visionsfcu.com
https://www.winweb.seceti.it
https://www1.internet-trading1.com
https://www1.net.hsbc.com
Industrial State Bank
Internet Banking
Juniper - Save Time and Money with the Juniper Credit Card
Kansas State Bank
Kendall State Bank
KeyPoint Credit Union
LAFCU
LloydsTSB online - Welcome
Login - Commerce Bank
Login - Peoples Bank
Mid America Bank in Baldwin City, KS
NatWest OnLine Banking
O n - L i n e
on line banking
Online Account Services
Online Services - Account Login
Personal Banking
Premier Bank
Security Bank of Kansas City
sempre
Sofinco : Cr
Sumx Banking
T&C Federal Credit Union: Home Page
The Bennington State Bank
The Mission Bank
The Trust Company of Kansas - Online Access
Unibanco.com
Union State Bank - Portal
United Commercial Bank
Valley View Bank
Web Banking
Welcome to Brenham National Bank
Welcome To Metcalf Bank
Wells Fargo Home Page
www.aaztecgold.com
www.abgoldcommerce.com
www.gitgold.com
www.goldcurrencies.ca
www.londongoldexchange.com
www.metal-escrow.com
www.omnipay.com
www.socgen.com
www.tampaexchange.net
www.thebullionexchange.com
Zions Bank: Home Page