Worm/Bobic.Crypt - Worm

See also

Summary

Full description

Statistics

Virus:	Worm/Bobic.Crypt
Date discovered:	14/09/2005
Type:	Worm
In the wild:	No
Reported Infections:	Low
Distribution Potential:	Medium
Damage Potential:	Low
Static file:	Yes
File size:	42.887 Bytes
MD5 checksum:	1219697f35ba9ad7d33fa21dd18050f0
Engine version:	6.32.0.5

General Methods of propagation:
   • Email

Aliases:
   • Bitdefender: Win32.Worm.Bobic.M

Platforms / OS:
   • Windows 98
   • Windows 98 SE
   • Windows NT
   • Windows ME
   • Windows 2000
   • Windows XP

Side effects:
   • Blocks access to certain websites
   • Registry modification

Files It copies itself to the following location:
   • %TEMPDIR%\%random character string%

It tries to download some files:

– The location is the following:
   • **********.1dumb.com/reg?u=494E8737&v=190&s=29245&su=27220&p=1&e=0&o=0&a=1&wr=75

– The location is the following:
   • **********.dynserv.com/reg?u=494E8737&v=190&s=25121&su=24849&p=0&e=0&o=0&a=0&wr=75

– The location is the following:
   • **********.1dumb.com/reg?u=494E8737&v=190&s=29245&su=27220&p=1&e=0&o=0&a=1&wr=75

– The location is the following:
   • **********.1dumb.com/reg?u=494E8737&v=190&s=29245&su=27220&p=1&e=0&o=0&a=1&wr=75

– The location is the following:
   • **********.3-a.net/reg?u=494E8737&v=190&s=29245&su=27220&p=1&e=0&o=0&a=1&wr=75

– The location is the following:
   • **********.3-a.net/reg?u=494E8737&v=190&s=29245&su=27220&p=1&e=0&o=0&a=1&wr=75

– The location is the following:
   • **********.dynserv.com/reg?u=494E8737&v=190&s=25121&su=24849&p=0&e=0&o=0&a=0&wr=75

– The location is the following:
   • **********.3-a.net/reg?u=494E8737&v=190&s=25121&su=24849&p=0&e=0&o=0&a=0&wr=75

– The location is the following:
   • **********.1dumb.com/reg?u=494E8737&v=190&s=29245&su=27220&p=1&e=0&o=0&a=1&wr=75

– The location is the following:
   • **********.3-a.net/reg?u=494E8737&v=190&s=25121&su=24849&p=0&e=0&o=0&a=0&wr=75

– The location is the following:
   • **********.hn.org/reg?u=494E8737&v=190&s=25121&su=24849&p=0&e=0&o=0&a=0&wr=75

– The location is the following:
   • **********.3-a.net/reg?u=494E8737&v=190&s=29245&su=27220&p=1&e=0&o=0&a=1&wr=75

– The location is the following:
   • **********.1dumb.com/reg?u=494E8737&v=190&s=25121&su=24849&p=0&e=0&o=0&a=0&wr=75

Registry The following registry key is changed:

– [HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess]
   Old value:
   • "Start"=%user defined settings%
   New value:
   • "Start"=dword:00000004

Email It contains an integrated SMTP engine in order to send Spam emails. A direct connection with the destination server will be established. The characteristics are described in the following:

From:
The sender address is spoofed.
Gathered addresses from the internet. Please do not assume that it was the senders intention to send this email to you. He might not know about his infection or might not even be infected at all. Furthermore it is possible that you will receive bounced emails that tell you that you are infected. This might also not be the case.

To:
– Gathered addresses from the internet.

Subject:
One of the following:
   • $320,000 for less than $600 a month!; $325,000 for less than $613 a
      month!; ...; After 30 years.; Antoinette!; Attack obesity; Aurelia!;
      Bill!; Bobby!; Brain?; Bridgett!; Burn body fat; Burn calories;
      Darryl!; Dena!; Emma!; Emmett!; Erich!; Feel full and satisfied all
      day long; Frances!; FW: FW: your private invitation %two-digit random
      character string%-%random character string%.; Fwd: Look your best
      during the summer months; Gary!; Get your personalized rate quote
      NOW!; Getting back to you.; Ginger!; Gracie!; Harley!; Haunted by your
      credit score?; Haunted by your past?; Hello.; Hey Alejandro!; Hey
      Amelia!; Hey Barbara!; Hey Barry!; Hey Betsy!; Hey Britney!; Hey
      Casandra!; Hey Charmaine!; Hey Clara!; Hey Clement!; Hey Colby!; Hey
      Dina!; Hey Dorothy!; Hey Flora!; Hey Genaro!; Hey Ivory!; Hey Jack!;
      Hey Jessica!; Hey Johnnie!; Hey Joshua!; Hey Justin!; Hey Kerri!; Hey
      Liza!; Hey Luella!; Hey Orville!; Hey Raphael!; Hey Reginald!; Hey
      Rosalie!; Hey Shawn!; Hey Sophie!; Hey Tamika!; Hey Tom!; Hey
      Winfred!; Hey!; Hey.; Hola!; How are you?; Imelda!; Increase your
      energy levels; Increase your metabolism; Invitation.; Jayson!; Joann!;
      Jonah!; Just reduce it.; Kelvin!; Lara!; Leonard!; Loretta!; Lose
      excess weight; Maintain your weight loss; Make losing weight a sure
      guarantee; Marcia!; Margo!; Maximum results seen after only a few
      weeks; Mortgage News Update.; No known side effects; Octavio!;
      Pauline!; Personalized mortgage rate quote!; Pre-approved Application
      %%four-digit random character string% |; Rate Quote for free!; Re:;
      re:%two-digit random character string%; Re: abbreviate.; Re: amarillo;
      Re: belie.; Re: blackball.; Re: burdock; Re: Burn.; Re: canvas; Re:
      carbonic; Re: chariot; Re: chimera.; Re: colatitude.; Re: command.;
      Re: comprehensible.; Re: confabulate; Re: congressmen.; Re: contain;
      Re: dale; Re: demur.; Re: dhabi.; Re: dieldrin.; Re: dime.; Re: ed.;
      Re: essex; Re: evaluable; Re: Favour.; Re: formulate.; Re: fusiform;
      Re: gland.; Re: global; Re: goatherd.; Re: goodwill; Re: harvey.; Re:
      haulage.; Re: hausdorff; Re: Hello.; Re: Help.; Re: herein; Re: Hey.;
      Re: hypoactive; Re: imp; Re: index.; Re: jeep.; Re: lithospheric.; Re:
      mac.; Re: marque.; Re: matchmake; Re: melinda; Re: minot.; Re: morton;
      Re: nepenthe; Re: network; Re: octogenarian; Re: parch.; Re: partake;
      Re: pinwheel; Re: plagioclase.; Re: procrustean; Re: pudding; Re:
      quetzal; Re: rancho; Re: ravine.; Re: redbud.; Re: regressive.; Re:
      relate.; Re: Request!; Re: roth.; Re: rowley.; Re: scientist; Re:
      shown.; Re: skunk.; Re: sloppy; Re: snappy.; Re: stephanotis; Re:
      strongroom.; Re: taxonomy; Re: teaspoonful.; Re: The miracle.; Re:
      thrift; Re: transposition; Re: tuberculin; Re: utter; Re: westminster;
      Re: Your order.; Request.; Response to your request.; Suitable for
      vegetarians and vegans; Summer!; Suppress your appetite; The miracle.;
      Truman!; Two hundred and thirty thousand dollars for only $320/month;
      Tyler!; Victoria!; Wilmer!; Your order:%four-digit random character
      string%.; Your order:%four-digit random character string%. You have
      been refunded.

In some cases the subject might also be empty.

Body:
The body of the email is the following:

   • We are happy to present you with six deals from four different brokers.
     Please remember that there is no commitment required on your part, and your credit is not an issue.
     Please validate your information with our secure and private database to ensure our records are up to date and accurate.
     http://**********rns.com/p1.asp
      Have a good day.
      Sincerely,
     %username from sender's email address%
     Customer Service Rep.
     eKLID Inc.

Continued by the following:

   • %random words%

The email may look like one of the following:

Hosts The host file is modified as explained:

– In this case already existing entries remain unmodified.

– Access to the following domain is effectively blocked:
   • 255.255.255.255 ar.atwola.com atdmt.com avp.ch avp.com avp.ru
      awaps.net ca.com dispatch.mcafee.com download.mcafee.com
      download.microsoft.com downloads.microsoft.com engine.awaps.net
      f-secure.com ftp.f-secure.com ftp.sophos.com go.microsoft.com
      liveupdate.symantec.com mast.mcafee.com mcafee.com msdn.microsoft.com
      my-etrust.com nai.com networkassociates.com office.microsoft.com
      phx.corporate-ir.net secure.nai.com securityresponse.symantec.com
      service1.symantec.com sophos.com spd.atdmt.com support.microsoft.com
      symantec.com update.symantec.com updates.symantec.com us.mcafee.com
      vil.nai.com viruslist.ru windowsupdate.microsoft.com www.avp.ch
      www.avp.com www.avp.ru www.awaps.net www.ca.com www.f-secure.com
      www.kaspersky.ru www.mcafee.com www.my-etrust.com www.nai.com
      www.networkassociates.com www.sophos.com www.symantec.com
      www.trendmicro.com www.viruslist.com www.viruslist.ru www3.ca.com

The modified host file will look like this:

Backdoor As a result remote control capability is provided.

Injection – It injects itself into a process.

Process name:
• %WINDIR%\Explorer.exe

File details Runtime packer:
In order to aggravate detection and reduce size of the file it is packed with the following runtime packer:
• Neolite

See a brief description here.

Description inserted by Victor Tone on Thu, 15 Sep 2005 17:17 (GMT+1)
Description updated by Victor Tone on Tue, 20 Sep 2005 14:39 (GMT+1)

» About Malware
» About Phishing
» Viruses In the Wild

« back