Worm/Slanec.A - Worm

See also

Summary

Full description

Statistics

Virus:	Worm/Slanec.A
Date discovered:	24/08/2005
Type:	Worm
In the wild:	Yes
Reported Infections:	Low
Distribution Potential:	Low to medium
Damage Potential:	Low to medium
Static file:	Yes
File size:	267.264 Bytes
MD5 checksum:	4e57e495c6106c2363a16ce92b262115
VDF version:	6.29.0.112

General Method of propagation:
   • Messenger

Aliases:
   • Symantec: W32.Bropia.L
   • Mcafee: W32/Bropia.worm.i
   • Kaspersky: IM-Worm.Win32.Bropia.a
   • TrendMicro: WORM_BROPIA.G
   • Grisoft: Worm/Slanec.A
   • VirusBuster: Worm.Slanec.A
   • Bitdefender: Win32.Worm.Bropia.G

Platforms / OS:
   • Windows 95
   • Windows 98
   • Windows 98 SE
   • Windows NT
   • Windows ME
   • Windows 2000
   • Windows XP
   • Windows 2003

Side effects:
   • Drops malicious files

It displays the content of a created pictorial file:

The picture has been edited for display purpose.

Files It copies itself to the following location:
   • %SYSDIR%\msnmsr.exe

It drops a copy of itself using a filename from a list:
– To: c:\ Using one of the following names:
   • naked_drunk.pif
   • Webcam.pif
   • bedroom-things.pif
   • naked_drunk.pif
   • my_pussy.pif
   • ROFL.pif
   • underware.pif
   • Hot.pif
   • new_webcam.pif

– c:\sexy.jpg Furthermore it gets executed after it was fully created.
– c:\cz.exe Furthermore it gets executed after it was fully created. Further investigation pointed out that this file is malware, too. Detected as: coming soon

Messenger It is spreading via Messenger. The characteristics are described below:

– MSN Messenger

To:
All entries in the contact list.

Propagation via file
It sends a file with one of the following filenames:
   • naked_drunk.pif
   • Webcam.pif
   • bedroom-things.pif
   • naked_drunk.pif
   • my_pussy.pif
   • ROFL.pif
   • underware.pif
   • Hot.pif
   • new_webcam.pif

Miscellaneous Mutex:
It creates the following Mutex:
   • ShimCacheMutex

Anti debugging
It checks if one of the following files are present:
   • "updates.exe"
   • "winis.exe"
   • "adaware.exe"
   • "win32s.exe"

If this was successful it does not create any files.

File details Programming language:
The malware program was written in Visual Basic.

Runtime packer:
In order to aggravate detection and reduce size of the file it is packed with the following runtime packer:
• Neolite 2.0

See a brief description here.

Description inserted by Catalin Jora on Thu, 25 Aug 2005 14:27 (GMT+1)
Description updated by Catalin Jora on Wed, 07 Sep 2005 10:43 (GMT+1)

» About Malware
» About Phishing
» Viruses In the Wild

« back