VBS/Staple.A - VBS script virus

Siehe auch

Vollständig

Alias:	VBS/Staple.a@MM
Type:	Worm
Size:	12.992 Bytes
Origin:
Date:	03-21-2001
Damage:	Sent by email to the first 50 Outlook addresses.
VDF Version:	6.23.00.00
Danger:	Low
Distribution:	Medium

DistributionVBS/Staple.A is a VBS (Visual Basic Script)worm and sends itself using Microsoft Outlook to the first 50 addresses found in Outlook Address Book. The email sent by the worm looks like this:

Subject: RE:Injustice
Body: Dear %Emailaddress% Did you send the attachment message, I was not expecting this from you !
Attachment: INJUSTICE.TXT.VBS

VBS/Staple.A also sends a copy of the email to the following addresses:

amuta@ehudbarak.co.il
arie@kba.org
doar@mof.gov.il
doar@shaam.gov.il
foundation@habonimdror.org
hachnasot@mof.gov.il
holyland@inisrael.org
info@azm.org
mafkal@police.gov.il
menahel@saam.gov.il
naamatusa@naamat.org
ncli@laborisrael.org
office@JAFI.org.il
pniotmas@mof.gov.il
rmarkus@parliament.gov.il
Sar@mod.gov.il
sar@mof.gov.il
Sar@moin.gov.il
Sar@mops.gov.il
webmaster@israel.com
wlzm@jazo.org.il
yor@knesset.gov.il

Technical DetailsAfter sending the email, the following registry entry is made:
HKEY_CURRENT_USER\Software\Microsoft\WAB\"&mailed,1,"REG_DWORLD"

and the following Internet sites are automatically opened with Internet Explorer:

http://freesaj.org.uk
http://hanthala.virualave.net
http://www.palestine-info.org
http://www.petitiononline.com/palpet/petition.html
http://www.sabra-shatilia.org
http://www.ummah.net/unity/palestine/index.htm

Finally, a window appears, named:
"HELP US STOP THE BLOOD SHED!!":

Kurzfassung hier.

Beschreibung erstellt von Crony Walker am Tue, 15 Jun 2004 14:00 (GMT+1)

» Über Malware
» Über Phishing
» In-the-Wild-Viren

« zurück