Worm/Sasser.D - Worm

Siehe auch

Vollständig

Alias:	W32/Sasser-D, WORM_SASSER.D, W32/Sasser.worm.d, Win32.Sasser
Type:	Worm
Size:	16,384 Bytes
Origin:	unknown
Date:	05-03-2004
Damage:	Uses LSASS security hole (Microsoft Security Bulletin MS04-011)
VDF Version:	6.25.00.60 - Wed, 12 May 2004 14:42 (GMT+1)
Danger:	Medium
Distribution:	High

General DescriptionThe worm makes sure that only one version of itself is active, using a Mutex
(SkynetSasserVersionWithPingFast). It copies itself as %WinDIR%\skynetave.exe and makes the following entry in Windows registry:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
CurrentVersion\Run
"skynetave.exe"="%WinDIR%\skynetave.exe"

The Lsass.exe process will be finished when the worm uses the Windows LSASS security hole. Windows sends a message and shuts the system down in a minute. The file C:\win2.log contains the IP addresses and the number of the infected computer.

Technical DetailsIt starts a FTP server over TCP Port 5554. This server is used for spreading the worm to other systems. It collects IP addresses from the infected systems and generates new IP addresses, similar to the ones it gathered.

It contacts on TCP Port 445 other systems, which did not close the LSASS security hole. When connected, it sends to it a Shell Code to open the TCP Port 9996. After that, it will use TCP Port 5554 to send a copy of the worm to the clean computer. This copy has a name of 4 or 5 numbers, followed by _up.exe. For example: 74354_up.exe.

Kurzfassung hier.

Beschreibung erstellt von Crony Walker am Sun, 20 Mar 2005 04:00 (GMT+1)

» Über Malware
» Über Phishing
» In-the-Wild-Viren

« zurück