Worm/Hybris.PI.11 - Worm

Siehe auch

Vollständig

Alias:	W32/Hybris.dll@MM, W95/Hybris.worm.B, W95.Hybris.gen
Type:	Worm
Size:	25,088 Bytes
Origin:
Date:	00-00-0000
Damage:	Spreads through newsgroups.
VDF Version:
Danger:	Low
Distribution:	Low

DistributionThis is the message structure:
anon.lcs.mit.edu!nym.alias.net!mail2news
Message-ID: 20001113080521.28781.qmail@nym.alias.net
From: [USE-AUTHOR-ADDRESS-HEADER@[127.1]]
Author-Address: anonymous [AT]anon [DOT]lcs [DOT]mit [DOT] edu
Subject: http [code containing upper- and lower-case letters] Mail-To-News-Contact: postmaster@nym.alias.net
Organization: mail2news@nym.alias.net
Newsgroups: alt.comp.virus
Lines: 46
KUWJGJWCVICGIWIWCZIWHCFXCHB
[continues].... [more coded lines]
[terminated by four asterisks] ****

@@@@ or SPIRALE - It displays spiral graphics, that can not be stopped or closed. The file name has 8 random letters.
I_RZ - a .zip or .rar archived worm copy, containing an .exe file.
AVIP or AVINET.DAT - does not allow the infected computer to open antivirus websites.
SUB7 - Searches for computers infected with Backdoor-G Trojan, copies and runs itself on the infected systems.
ENCR or POLY
TEXT or PR0N - creates a message sent with the virus, according to the infected system's language.

From: Hahaha [hahaha@sexyfun.net]

Subject:
Snowhite and the Seven Dwarfs - The REAL story!
Les 7 coquir nains *or*
Blanche neige et ...les sexe nains
Enanito si, pero con que pedazo!
Branca de Neve pornô!

Body:
Today, Snowhite was turning 18. The 7 Dwarfsalways where very educated and polite with Snowhite.When they go out work at mornign, they promissed a*huge* surprise. Snowhite was anxious. Suddlently, thedoor open, and the Seven Dwarfs enter...

C'etait un jour avant son dix huitiemeanniversaire. Les 7 nains, qui avaient aidé 'blancheneige' toutes ces années après qu'elle se soit enfuit dechez sa belle mère, lui avaient promis une *grosse*surprise. A 5 heures comme toujours, ils sont rentrés dutravail. Mais cette fois ils avaient un air coquin...

Faltaba apenas un dia para su aniversario de de 18años. Blanca de Nieve fuera siempre muy bien cuidada porlos enanitos. Ellos le prometieron una *grande* sorpresapara su fiesta de compleaños. Al entardecer, llegaron.Tenian un brillo incomun en los ojos...

Faltava apenas um dia para o seu aniversario de18 anos. Branca de Neve estava muito feliz e ansiosa,porque os 7 anões prometeram uma *grande* surpresa.As cinco horas, os anõezinhos voltaram do trabalho.Mas algo nao estava bem... Os sete anõezinhos tinhamum estranho brilho no olhar...

Attachment:
sexy virgin.scr
joke.exe
midgets.scr
dwarf4you.exe
blancheneige.exe
sexynain.scr
blanche.scr
nains.exe
enano.exe
enano porno.exe
blanca de nieve.scr
enanito fisgon.exe
branca de neve.scr
atchim.iexe
dunga.scr
anão pornô.scr

A later version of the worm sends emails using the following words:
"Anna"
"Raquel Darian"
"Xena"
"Xuxa"
"Suzete"
"famous"
"celebrity rape"
"leather"
"sex"
"sexy"
"hot"
"hottest"
"cum"
"cumshot"
"horny"
"anal"
"gay"
"oral" etc.

If Hybris has no PlugIn function, it sends a message without any subject or sender.

Technical DetailsWhen activated, W95/Hybris.PI.11 tries to infect WSOCK32.DLL in %Windir%/%Systemdir%. If it can not infect the file directly, because it is already in use, the worm creates an infected copy of WSOCK32.DLL. The file name has 8 characters and no extension.

It registers the new WSOCK32.DLL file in WININIT.INI, for autostart.

The modified WSOCK32.DLL file monitors the Internet activity and tries to email an .exe or .scr worm copy.

Kurzfassung hier.

Beschreibung erstellt von Crony Walker am Tue, 15 Jun 2004 14:00 (GMT+1)

» Über Malware
» Über Phishing
» In-the-Wild-Viren

« zurück