Virus:Worm/Kipis.U
Date discovered:21/09/2005
Type:Worm
In the wild:Yes
Reported Infections:Low
Distribution Potential:Medium to high
Damage Potential:Medium
Static file:Yes
File size:7.856 Bytes
MD5 checksum:3030c85b4a6135a1d35bd9ab2d1bfe6b
VDF version:6.32.00.35

 General Methods of propagation:
   • Email
   • Peer to Peer


Aliases:
   •  Symantec: W32.Kipis.A@mm
   •  Mcafee: W32/Kipis.u@MM
   •  Kaspersky: Email-Worm.Win32.Kipis.u
   •  TrendMicro: WORM_KIPIS.M
   •  Sophos: W32/Kipis-U
   •  Grisoft: I-Worm/Kipis.AC
   •  VirusBuster: I-Worm.Kipis.L
   •  Eset: Win32/Kipis.U
   •  Bitdefender: Win32.Kipis.U@mm


Platforms / OS:
   • Windows 98
   • Windows 98 SE
   • Windows NT
   • Windows ME
   • Windows 2000
   • Windows XP
   • Windows 2003


Side effects:
   • Disable security applications
   • Uses its own Email engine
   • Registry modification
   • Third party control

 Files It copies itself to the following locations:
   • %WINDIR%\regedit.com
   • %SYSDIR%\Microsoft\iexplore.exe




It tries to executes the following file:

– Filename:
   • %SYSDIR%\NOTEPAD.EXE
using the following command line arguments: %WINDIR%\win.ini

 Registry The following registry key is added:

– HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WOW\boot
   • "shell"="%SYSDIR%\Microsoft\iexplore.exe"



The following registry key is changed:

– HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
   Old value:
   • "Shell"="Explorer.exe"
   New value:
   • "Shell"="Explorer.exe %SYSDIR%\Microsoft\iexplore.exe"

 Email It contains an integrated SMTP engine in order to send emails. A direct connection with the destination server will be established. The characteristics are described in the following:


From:
The sender address is spoofed.
Generated addresses. Please do not assume that it was the sender's intention to send this email to you. He might not know about his infection or might not even be infected at all. Furthermore it is possible that you will receive bounced emails telling you that you are infected. This might also not be the case.


To:
– Email addresses found in specific files on the system.
– Email addresses gathered from WAB (Windows Address Book)


Subject:
One of the following:
   • Access denied; Re: Love message; Re: 666; Re: I Gey; Re: FUCK YOU!;
      Re: Meeting of gays; Me email; Hotmail password; Re: Crack; Chat
      notify!; Your Dead!; The Cannabis; Re: New Exploit for Windows XP; Re:
      Exploit for Outlook Express 6.0; Love you!; Treffpunkt; Re: Meine
      Daten; Ich liebe dich; Re: Mit dem Geburtstag; Re: Die Begegnung geev;
      Den Vertrag; Re: La Rencontre CHata; Re: rencontre a 15:30; Re: Mes
      donnees; Re: Je t'aime; Avec l'anniversaire; Re: La rencontre des
      gays; Re: El encuentro Chata; Re: Encuentro en 15:30; Re: Mi dados;
      Re: te amo; Con el dia del nacimiento; Re: el Encuentro de los gays



Body:
The body of the email is one of the lines:
   • All right..
   • Thank you..!
   • Agreed...
   • I will come well.
   • Successes..
   • Congrulate..!
   • Danke..
   • Haben sich vereinbart..
   • Gut werde ich.
   • des Erfolges..
   • Danke erreichen.
   • Merci..
   • Bien..
   • Ont convenu..
   • Est d'accord.
   • Je viens bien...
   • De la chance, merci.
   • Gracias Han acordado..
   • esta bien..
   • vendre Bien.
   • los Aciertos..
   • Gracias!


Attachment:
The filename of the attachment is constructed out of the following:

–  It starts with one of the following:
   • Contracto
   • Dados
   • das Dokument
   • data
   • Daten
   • Den Text
   • des Einzelteil
   • die Mitteilung
   • Documento
   • Donnees
   • el Detalle
   • el mensaje
   • El texto
   • info
   • Information
   • la Info
   • le Document
   • le message
   • Le texte
   • Les details
   • Like
   • misk
   • Note
   • postmaster
   • price
   • readme
   • text

Continued by one of the following:
   • ..
   • .+
   • _.
   • +.sCR+

    The file extension is one of the following:
   • sCR
   • scR
   • ScR

The attachment is a copy of the malware itself.



The email looks like the following:


 Mailing Search addresses:
It searches the following files for email addresses:
   • .wab; .txt; .adb; .doc; .dhtm; .php; .msg; .dbx; .tbb; .shtm; .uin;
      .xls; .eml; .pab; .htm


Address generation for FROM field:
To generate addresses it uses the following strings:
   • kevin
   • adam
   • linda
   • anna
   • alex
   • david
   • mary
   • maria
   • brenda
   • rosa

It combines the result with domains that were found in files, which were previously searched for addresses.


Avoid addresses:
It does not send emails to addresses containing one of the following strings:
   • .@microsof; rating@; f-secur; news@; update@; rar@; newvir; anyone@;
      bugs@; contract@; sales@; help@; info@; nobody@; noone@; @kasper;
      admin@; support@; antivir; bsd; listserv; @sopho; @foo; @iana;
      free-av; @messagelab; winzip; google; winrar; abuse@; @panda; @mcafee;
      pgp; @avp.; noreply; root@; postmaster@; @mydomai; podpiska@; mailer-;
      webmaster@; register@; @borlan; @nodomai; @virusli; virus@; @symante;
      @nod3; @bitdefen; @klamav; @drweb; @norman; @fido; @usenet; @ietf;
      @rfc-ed; technical@; suporte@; mozzila; you@; site@; contact@; soft@;
      privacy@; accoun; @license; @somedomai; service@; the.bat; page@;
      spm111@; notice@


Prepend MX strings:
In order to get the IP address of the mail server it has the ability to prepend the following strings to the domain name:
   • @smtp.
   • mx.
   • mx1.
   • mail.
   • mxs.
   • mail1.
   • relay.
   • ns.
   • gate.

 P2P In order to infect other systems in the Peer to Peer network community the following action is performed:  


–   It searches for directories that contain one of the following substrings:
   • share
   • microsof

   If successful, the following files are created:
   • Land Attack(source and files).exe
   • DDoS bot(src)..scr
   • Forum Hack.txt.scr
   • Winamp 6(plugins).exe
   • Crack collection.scr
   • NLP.scr
   • Hack Unix Server(info).scr
   • Screensaver for Hackers.scr
   • Windows 2000(source code).scr
   • Hack Chat.exe
   • Kaspersy Antivirus Key(ver.5.xx,Pro,Personal).exe

   These files are copies of the malware itself.

 Process termination Processes with one of the following strings are terminated:
   • anvir; apv; avc; aveng; avg; avk; avp; avw; avx; blackd; blacki; blss;
      cfi; clean; defwat; drweb; egedit.ex; ewall; fsa; fsm; guard; hijack;
      hxde; ilemon; kerio; klagent; klamav; luacomserv; minilog.; monitor;
      mooli; mosta; mpf; nav; neomon; netarm; netspy; nisse; nisum; nod3;
      nod3; norman; normis; norton; outpos; pav; pavsrv; pcc; protect;
      proxy.; rav; rfw; spider; svc.; syman; taskmgr; tmon; trojan; updat;
      upgrad; virus; vsmon; zapro.; zonalm; zonea


 Backdoor The following port is opened:

– %malware execution directory%\%executed file% on TCP port 137 in order to provide backdoor capabilities.

 Miscellaneous Mutex:
It creates the following Mutex:
   • [+] -- KiPiSH -- [+]

 File details Programming language:
 The malware program was written in MS Visual C++.


Runtime packer:
In order to aggravate detection and reduce size of the file it is packed with the following runtime packer:
   • FSG

Description inserted by Irina Boldea on Tuesday, September 12, 2006
Description updated by Irina Boldea on Tuesday, September 12, 2006

Back . . . .