Worm/Mydoom.G - Worm

Siehe auch

Vollständig

Alias:	W32/Mydoom.g@MM, W32.Mydoom.G@mm
Type:	Worm
Size:	29,696 bytes
Origin:	unknown
Date:	03-02-2004
Damage:	Sends itself by email
VDF Version:	6.24.00.35 - Wed, 03 Mar 2004 00:47 (GMT+1)
Danger:	Low
Distribution:	Medium

General DescriptionThis worm sends itself, like its predecessors, to email addresses found on the infected system.

Symptoms* Open TCP port 1080
* Presence of the mentioned registry entries
* Presence of the mentioned files
* Increased email traffic
* Notepad is opened with "data garbage"

Distribution* Sends itself via email using its own smtp engine

Technical DetailsWorm/Mydoom.G has a file size of 29.696 bytes. The file is packed with UPX. In the unpacked version of Worm/MyDoom.G, one can find the following text strings: "to netsky's creator(s) imho, skynet is a decentralized peer-to-peer neural network. we have seen P2P in Slapper in Sinit only. they maybe called skynets, but not your shitty app."

The worm will copy itself as:

* %System%\<random name1>.exe

Furthermore a DLL file with random file name will be created:

* %System%\<random name2>.dll (> 9 KB)

Another file will be created in %Temp%, containg random characters, which will be opened with notepad:

* %Temp%\Message (4185 bytes)

The worm scans the temporary internet files and the Windows folder for email addresses. In addition it will scan for email addresses all drives in files with the following extensions:

* adb
* asp
* dbx
* eml
* htm
* mbx
* mht
* mmf
* msg
* nch
* php
* rtf
* sht
* tbb
* txt
* uin
* wab

The return address is spoofed and the attached file will have a random name and one of the following extensions: exe, scr, bat, pif, cmd, com. It is also possible to sends itself in a zip archive having a random name. This is sometimes also password-protected. The password randomly selected is mentioned in the email.
The subject is randomly selected from one the following:

* <blank>
* :)
* :-)
* Address verification
* Alert
* Attention
* Auto-reply
* Automatic notification
* Bank information
* Daily Report
* Email verification
* Empty
* Expired account
* For your eyes only
* Interesting
* Micro$oft
* Microsoft
* Please, confirm the registration
* Registration
* Registration rejected
* Rejected
* Reply
* Request
* Response
* See you soon
* Warning
* You have been successfully registered
* Your account details
* Your account is about to be expired
* Your account is expired
* Your details
* Your profile
* Your request
* account details
* anna
* beauty
* confirmed
* corrupted
* dear friend!
* details
* do you love me
* do you still love me
* document
* excel
* excuse me
* from me
* fw:
* greetings
* hello
* hello
* hello my friend
* hello! :)
* here
* here is the document
* hey
* hey!
* hi!
* hi! :)
* how are you?
* i can tell you the future
* i need you
* important
* jessica
* join
* just some stuff
* kate
* kleopatra
* maria
* melissa
* message
* micro$oft must die. support us!
* missed
* my details
* my photos
* notification
* pamela
* photo
* please read
* price
* price list
* price-list
* pricelist
* question
* re:
* read!!!
* report
* see you
* service
* some stuff
* spreadsheet
* stuff
* summary
* thank you
* thanks
* thanks!
* unknown
* verification
* we're experiencing technical problems
* we're unable to process your request
* your account
* your archive
* your chance
* your document
* your letter
* your music
* your website

The "Body" of the email is randomly selected from one the following:

* Please read the attached file
* Your document is attached
* Read this.
* just some stuff
* Details are in the attached document
* Full message is in the attached documen
* Here is the document
* Here is the file
* Here it is
* Hi! Check the attachment for details
* Look at the attached file
* Look at the document
* Ok
* Okay
* Open the document
* Please have a look at the attached file
* Please read the attached file
* Please, read and let me know what do yo
* Please, reply
* Re:
* Read the attached message
* Read the document
* Read this
* See attachemnt
* See attachment
* See the attached document
* See the attached file for details
* See the attached message
* See you
* Test
* Your document is attached
* Your file is attached
* test

The attachment name is randomly constructed. The base file name is selected from the following:

* 454543403
* aboutyou
* account
* all_document
* application
* archive
* associal
* att
* attach
* attach2
* AttachedDocument
* AttachedFile
* attachment
* auction
* bill
* birth
* card
* check
* class
* concert
* concert
* creditcard
* death
* description
* details
* dinner
* disco
* doc
* document
* Document
* file
* final
* for_you
* found
* freaky
* friend
* id
* image
* important
* incest
* info
* information
* injection
* intimate stuff
* jokes
* letter
* Letter
* letter
* location
* mail
* mail2
* mails
* masturbation
* material
* me
* message
* message_details
* message_part2
* misc
* moonlight
* more
* MoreInfo
* msg
* msg2
* music
* myaunt
* mydate
* naked1
* naked2
* news
* no
* nomoney
* note
* nothing
* object
* part2
* party
* payment
* paypal
* pic
* portmoney
* post
* poster
* posting
* price
* problem
* product
* ps
* ranking
* readme
* regards
* regid
* release
* reply
* response
* schock
* secrets
* sexual
* sexy
* shower
* story
* stuff
* swimmingpool
* talk
* tear
* test
* TextDocument
* textfile
* TextFile
* topseller
* transfer
* trash
* undefinied
* unfolds
* update
* violence
* visa
* warez
* webcam
* website
* wife
* word
* worker
* your
* yours
* zip

with one of the following extensions:

* zip
* exe
* scr
* bat
* pif
* cmd
* com

In addition the following entries are added in the Windows Registry:

* HKEY_CLASSES_ROOT\CLSID\{35CEC8A3-2BE6-11D2-8773-
92E220524153}\InProcServer32 "(default)" =
%SysDir%\(random name1).dll

* HKEY_CLASSES_ROOT\CLSID\{E6FB5E20-DE35-11CF-9C87-
00AA005127ED}\InProcServer32 "(default)" =
%SysDir%\(random name1) dll

* HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\
CurrentVersion\Run "(coincidentally)" = %SysDir% \(random name2)
(with one of the following extensions: bat, exe, pif, cmd, or scr)

Worm/MyDoom.G contains a backdoor component, which listen on TCP port 1080 of the infected machine for instructions.

Worm/MyDoom.G will also start at 10 to 20 minutes after execution a DOS attack against www.symantec.com.

Kurzfassung hier.

Beschreibung erstellt von Crony Walker am Tue, 15 Jun 2004 14:00 (GMT+1)

» Über Malware
» Über Phishing
» In-the-Wild-Viren

« zurück