Worm/Kidala.G - Worm

See also

Summary

Full description

Statistics

Virus:	Worm/Kidala.G
Date discovered:	04/08/2006
Type:	Worm
In the wild:	Yes
Reported Infections:	Low
Distribution Potential:	High
Damage Potential:	Medium
Static file:	Yes
File size:	72.856 Bytes
MD5 checksum:	569eec9ad7abea95378c62e095693dcf
VDF version:	6.35.01.46 - Fri, 04 Aug 2006 06:39 (GMT+1) - Fri, 04 Aug 2006 06:39 (GMT+1)
IVDF version:	6.35.01.46 - Fri, 04 Aug 2006 06:39 (GMT+1) - Fri, 04 Aug 2006 06:39 (GMT+1)

General Methods of propagation:
   • Email
   • Local network
   • Peer to Peer

Aliases:
   • Kaspersky: Net-Worm.Win32.Kidala.g
   • Eset: Win32/Mytob.UA worm

Platforms / OS:
   • Windows 98
   • Windows 98 SE
   • Windows NT
   • Windows ME
   • Windows 2000
   • Windows XP
   • Windows 2003

Side effects:
   • Disable security applications
   • Uses its own Email engine
   • Lowers security settings
   • Makes use of software vulnerability
   • Third party control

Files It copies itself to the following location:
   • %SYSDIR%\VideoCall.exe

Sections are added to the following files.
– To: *.rar With the following contents:
   • %executed file%

It deletes the initially executed copy of itself.

It deletes the following files:
   • %SYSDIR%\speeder.exe
   • %SYSDIR%\PCspeeder.exe
   • %SYSDIR%\syscom.exe
   • %SYSDIR%\uptodate.exe
   • %SYSDIR%\fixed.exe
   • %SYSDIR%\msl.exe
   • %SYSDIR%\autoupdate.exe
   • %SYSDIR%\sword.exe
   • %SYSDIR%\lcd.exe
   • %SYSDIR%\lsd.exe
   • %SYSDIR%\win24.exe
   • %SYSDIR%\windows24.exe
   • %SYSDIR%\0.exe
   • %SYSDIR%\sysmon.exe
   • %SYSDIR%\loadwin.exe
   • %SYSDIR%\winloader.exe
   • %SYSDIR%\winload.exe
   • %SYSDIR%\player.exe
   • %SYSDIR%\microsystem.exe
   • %SYSDIR%\viewer.exe

Registry The following registry key is added in order to run the process after reboot:

– [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
   • Skype = %SYSDIR%\VideoCall.exe

The values of the following registry key are removed:

– [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
   • ISPup
   • PCup
   • com+
   • fixed
   • uptodate
   • msl
   • black
   • windows
   • lcd
   • lsdsystem
   • win24
   • Windows34
   • Bigen
   • win32
   • sys32x
   • systems

The following registry key is changed:

Deactivate Windows XP Firewall:
– [HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\
   FirewallPolicy\StandardProfile]
   Old value:
   • EnableFirewall = %user defined settings%
   New value:
   • EnableFirewall = 0

Email It contains an integrated SMTP engine in order to send emails. A direct connection with the destination server will be established. The characteristics are described in the following:

From:
The sender address is spoofed.
Generated addresses. Please do not assume that it was the sender's intention to send this email to you. He might not know about his infection or might not even be infected at all. Furthermore it is possible that you will receive bounced emails telling you that you are infected. This might also not be the case.

To:
– Email addresses found in specific files on the system.
– Generated addresses

Subject:
One of the following:
   • Error
   • Status
   • Server Report
   • Mail Transaction Failed
   • Mail Delivery System
   • Hello
   • Hi
   • Test

Body:
– In some cases it may be empty.
– In some cases it may contain random characters.
The body of the email is one of the lines:
   • Mail transaction failed. Partial message is available.
   • The message contains Unicode characters and has been sent as a binary attachment.
   • The message cannot be represented in 7-bit ASCII encoding and has been sent as a binary attachment.

Attachment:
The filename of the attachment is constructed out of the following:

– It starts with one of the following:
   • body
   • message
   • test
   • data
   • file
   • text
   • doc
   • readme
   • document

    The file extension is one of the following:
   • .bat
   • .cmd
   • .exe
   • .scr
   • .pif
   • .zip

The email may look like one of the following:

Mailing Search addresses:
It searches the following files for email addresses:
   • wab
   • adb
   • tbb
   • dbx
   • asp
   • php
   • sht
   • htm
   • txt

Address generation for FROM field:
To generate addresses it uses the following strings:
   • sandra; linda; julie; jimmy; jerry; helen; debby; claudia; brenda;
      anna; alice; brent; adam; ted; fred; jack; bill; stan; smith; steve;
      matt; dave; dan; joe; jane; bob; robert; peter; tom; ray; mary; serg;
      brian; jim; maria; leo; jose; andrew; sam; george; david; kevin; mike;
      james; michael; alex; john

It combines this with domains from the following list or from addresses found in files on the system

The domain is one of the following:
   • microsoft.com
   • msn.com
   • ayna.com
   • maktoob.com
   • usa.net
   • usa.com
   • yahoo.com
   • hotmail.com

Address generation for TO field:
To generate addresses it uses the following strings:
   • sandra; linda; julie; jimmy; jerry; helen; debby; claudia; brenda;
      anna; alice; brent; adam; ted; fred; jack; bill; stan; smith; steve;
      matt; dave; dan; joe; jane; bob; robert; peter; tom; ray; mary; serg;
      brian; jim; maria; leo; jose; andrew; sam; george; david; kevin; mike;
      james; michael; alex; john

It combines this with domains from the following list or from addresses found in files on the system

The domain is one of the following:
   • hotmail.com
   • yahoo.com
   • msn.com
   • aol.com

Avoid addresses:
It does not send emails to addresses containing one of the following strings:
   • .edu; abuse; www; fcnz; spm; accoun; certific; listserv; ntivi;
      support; icrosoft; admin; page; the.bat; gold-certs; feste; submit;
      not; help; service; privacy; somebody; soft; contact; site; rating;
      bugs; you; your; someone; anyone; nothing; nobody; noone; webmaster;
      postmaster; samples; info; root; mozilla; utgers.ed; tanford.e; pgp;
      acketst; secur; isc.o; isi.e; ripe.; arin.; sendmail; rfc-ed; ietf;
      iana; usenet; fido; linux; kernel; google; ibm.com; fsf.; gnu; mit.e;
      bsd; math; unix; berkeley; foo.; .mil; gov.; .gov; ruslis; nodomai;
      mydomai; example; inpris; borlan; sopho; panda; hotmail; msn.;
      icrosof; syma; avp

Prepend MX strings:
In order to get the IP address of the mail server it has the ability to prepend the following strings to the domain name:
   • gate.
   • ns.
   • relay.
   • mail1.
   • mxs.
   • mx1.
   • smtp.
   • mail.
   • mx.

P2P In order to infect other systems in the Peer to Peer network community the following action is performed:

– It searches for the following directories:
   • %PROGRAM FILES%\eDonkey2000\incoming\
   • %PROGRAM FILES%\\LimeWire\Shared\

   It retrieves shared folders by querying the following registry keys:
   • HKLM\Software\Kazaa\LocalContent\DownloadDir
   • HKLM\SOFTWARE\Morpheus\Install_Dir
   • HKLM\SOFTWARE\iMesh\Client\DownloadsLocation
   • HKCU\SOFTWARE\WarezP2P\wp

It searches for all shared directories.

   If successful, the following files are created:
   • Angilina_Jolie_Sucks_a_Dick; JenniferLopez_Film_Sexy_Enough;
      BritneySpears_SoSexy; DAP7.4.x.x_crack; NortonAV2006_Crack;
      Alcohol_120%%_patch; Outlook_hotmail+_fix; LimeWire_speed++;
      DarkAngel_Lady_get_fucked_so_hardly; nuke2006; office_crack;
      rootkitXP; dcom_patch; strip-girl-3.0; activation_crack;
      icq2006-final; winamp6; TaskCatcher; Opera8; notepad++;
      lcc-win32_update; RealPlayerv10.xx_crack; YahooMessenger_Loader;
      MSN7.0UniversalPatch; MSN7.0Loader; KAV2006_Crack;
      ZoneAlarmPro6.xx_Crack; nice_big_asshole_fuck_Jennifer_Lopez.scr;
      Madonna_the_most_sexiest_girl_in_the_world.com;
      Britney_Spears_sucks_someones_dick.scr;
      Mariah_Carey_showering_in_bathroom.com; ACDSee 9.com; Matrix 3
      Revolution English Subtitles.scr; Adobe Photoshop 9 full.com; WinAmp 5
      Pro Keygen Crack Update.com; WinAmp 6 New!.com; XXX hardcore
      images.scr; Opera 8 New!.com; Windown Longhorn Beta Leak.pif; Ahead
      Nero 7.com; Windows Sourcecode update.doc.pif; Porno pics arhive,
      xxx.scr; Kaspersky Antivirus 5.0.com; KAV 5.0.com; Serials.txt.bat;
      Porno Screensaver.scr; Porno, sex, oral, anal cool, awesome!!.scr;
      Microsoft Office XP working Crack, Keygen.pif; Microsoft Windows XP,
      WinXP Crack, working Keygen.pif; Microsoft Office 2003 Crack,
      Working!.pif

   These files are copies of the malware itself.

Network Infection In order to ensure its propagation the malware attemps to connect to other machines as described below.

Exploit:
It makes use of the following Exploits:
– MS01-059 (Unchecked Buffer in Universal Plug and Play)
– MS02-018 (Patch for Internet Information Service)
– MS02-061 (Elevation of Privilege in SQL Server Web)
– MS03-007 (Unchecked Buffer in Windows Component)
– MS03-026 (Buffer Overrun in RPC Interface)
– MS03-049 (Buffer Overrun in the Workstation Service)
– MS04-007 (ASN.1 Vulnerability)
– MS04-011 (LSASS Vulnerability)
– MS05-039 (Vulnerability in Plug and Play)
– VX05-006 (Remote Heap Overflow when using the VERITAS Backup Exec Admin Plus Pack Option)
– Bagle backdoor (port 2745)
– Mydoom backdoor (port 3127)
– Optix backdoor (port 3140)
– DameWare remote administration (port 6129)

IP address generation:
It creates random IP addresses while it keeps the first two octets from its own address. Afterwards it tries to establish a connection with the created addresses.

Infection process:
Creates a TFTP script on the compromised machine in order to download the malware to the remote location.

IRC – Furthermore it has the ability to perform actions such as:
    • Download file
    • Execute file
    • Perform DDoS attack

Spreading:
– It creates a file called script.ini in order to spread a copy of itself via IRC.

Process termination List of processes that are terminated:
   • AVPCC.EXE; AVKSERV.EXE; ECENGINE.EXE; FP-WIN.EXE; VETTRAY.EXE;
      ACKWIN32.EXE; AVNT.EXE; ESAFE.EXE; FPROT.EXE; F-PROT95.EXE;
      IOMON98.EXE; AVWIN95.EXE; AVE32.EXE; ANTI-TROJAN.EXE; _AVPCC.EXE;
      APVXDWIN.EXE; CLAW95CF.EXE; _FINDVIRU.EXE; FINDVIRU.EXE; NAVNT.EXE;
      VET95.EXE; SCAN32.EXE; RAV7.EXE; NAVAPW32.EXE; VSMAIN.EXE;
      GUARDDOG.EXE; RULAUNCH.EXE; ALOGSERV.EXE; OGRC.EXE; NAVAPSVC.EXE;
      NSPLUGIN.EXE; NOD32.EXE; _AVPM.EXE; AMON.EXE; NAVWNT.EXE; NAVW32.EXE;
      SPIDER.EXE; AVPM.EXE; ATGUARD.EXE; KAVPF.EXE; BLACKICE.EXE;
      LOOKOUT.EXE; CMGRDIAN.EXE; IAMAPP.EXE; OUTPOST.EXE;
      OUTPOSTINSTALL.EXE; ZONEALARM.EXE; ZONALM2601.EXE; ZATUTOR.EXE;
      ZAPSETUP3001.EXE; ZAPRO.EXE; OUTPOSTPROINSTALL.EXE; ZONALARM.EXE

Miscellaneous Mutex:
It creates the following Mutex:
• HGFSMUTEX

File details Programming language:
The malware program was written in MS Visual C++.

Runtime packer:
In order to aggravate detection and reduce size of the file it is packed with a runtime packer.

See a brief description here.

Description inserted by Andrei Gherman on Fri, 04 Aug 2006 10:21 (GMT+1)
Description updated by Andrei Gherman on Fri, 04 Aug 2006 13:51 (GMT+1)

» About Malware
» About Phishing
» Viruses In the Wild

« back