Worm/Lovgate.Q.2 - Worm

See also

Summary

Full description

Statistics

Virus:	Worm/Lovgate.Q.2
Date discovered:	31/03/2004
Type:	Worm
In the wild:	Yes
Reported Infections:	Low
Distribution Potential:	Medium to high
Damage Potential:	Medium
Static file:	Yes
File size:	114.176 Bytes
MD5 checksum:	bd35823ecdb52252312d403b54c8760D
VDF version:	6.24.00.77 - Wed, 31 Mar 2004 10:27 (GMT+1)

General Methods of propagation:
   • Email
   • Local network
   • Peer to Peer

Aliases:
   • Symantec: W32.Lovgate.R@mm
   • Mcafee: W32/Lovgate.q@MM
   • Kaspersky: Email-Worm.Win32.LovGate.q
   • TrendMicro: WORM_LOVGATE.Q
   • Sophos: W32/Lovgate-X
   • Grisoft: I-Worm/Lovgate.O
   • VirusBuster: I-I-Worm.Lovgate.AH
   • Eset: Win32/Lovgate.X
   • Bitdefender: Win32.Lovgate.R@mm

Platforms / OS:
   • Windows 95
   • Windows 98
   • Windows 98 SE
   • Windows NT
   • Windows ME
   • Windows 2000
   • Windows XP
   • Windows 2003

Side effects:
   • Drops malicious files
   • Uses its own Email engine
   • Lowers security settings
   • Registry modification
   • Third party control

Files It copies itself to the following locations:
   • %system drive root%\WINDOWS\SYSTRA.EXE
   • %system drive root%\COMMAND.EXE
   • %system drive root%\WINDOWS\System32\IEXPLORE.EXE
   • %system drive root%\WINDOWS\System32\RAVMOND.exe
   • %system drive root%\WINDOWS\System32\hxdef.exe
   • %system drive root%\WINDOWS\System32\kernel66.dll

It copies itself within archives to the following locations:
   • %system drive root%\WORK.ZIP
   • %system drive root%\WORK.RAR
   • %system drive root%\setup.ZIP
   • %system drive root%\setup.RAR
   • %system drive root%\Important.ZIP
   • %system drive root%\Important.RAR
   • %system drive root%\bak.ZIP
   • %system drive root%\bak.RAR
   • %system drive root%\letter.ZIP
   • %system drive root%\letter.RAR
   • %system drive root%\pass.ZIP
   • %system drive root%\pass.RAR

The following files are created:

– %system drive root%\WINDOWS\System32\ODBC16.dll Further investigation pointed out that this file is malware, too. Detected as: Worm/Lovgate.Q.1

– %system drive root%\WINDOWS\System32\msjdbc11.dll Further investigation pointed out that this file is malware, too. Detected as: Worm/Lovgate.Q.1

– %system drive root%\WINDOWS\System32\MSSIGN30.DLL Further investigation pointed out that this file is malware, too. Detected as: Worm/Lovgate.Q.1

– %system drive root%\WINDOWS\System32\NetMeeting.exe Further investigation pointed out that this file is malware, too. Detected as: Worm/Lovgate.W.1

– %system drive root%\AUTORUN.INF

Registry The following registry key is added in order to run the process after reboot:

– HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
   • "Protected Storage"="RUNDLL32.EXE MSSIGN30.DLL ondll_reg"
   • "Program In Windows"="%SYSDIR%\IEXPLORE.EXE"
   • "Microsoft NetMeeting Associates, Inc."="NetMeeting.exe"
   • "VFW Encoder/Decoder Settings"="RUNDLL32.EXE MSSIGN30.DLL ondll_reg"
   • "Hardware Profile"="%SYSDIR%\hxdef.exe"

The following registry keys are added in order to load the service after reboot:

– HKLM\SYSTEM\CurrentControlSet\Services\_reg
   • "Type"=dword:00000010
   • "Start"=dword:00000002
   • "ErrorControl"=dword:00000001
   • "ImagePath"=Rundll32.exe msjdbc11.dll ondll_server
   • "DisplayName"="_reg"
   • "ObjectName"="LocalSystem"

The following registry key is added:

– HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows
   • "run"="RAVMOND.exe"

Email It contains an integrated SMTP engine in order to send emails. A direct connection with the destination server will be established. The characteristics are described in the following:
It uses the Messaging Application Programming Interface (MAPI) in order to send a reply to emails stored in the inbox. The characteristics are further described:

From:
The sender address is spoofed.
Generated addresses. Please do not assume that it was the sender's intention to send this email to you. He might not know about his infection or might not even be infected at all. Furthermore it is possible that you will receive bounced emails telling you that you are infected. This might also not be the case.

To:
– Email addresses found in specific files on the system.
– Email addresses gathered from WAB (Windows Address Book)
– Generated addresses

Subject:
One of the following:
   • Error
   • Status
   • Server Report
   • Mail Transaction Failed
   • Mail Delivery System
   • hello
   • Re:%original subject%

Furthermore the subject line could contain random letters.

Body:
– In some cases it may contain random characters.

The body of the email is one of the lines:
   • Mail failed. For further assistance, please contact!
   • The message contains Unicode characters and has been sent as a binary attachment.
   • It's the long-awaited film version of the Broadway hit. The message sent as a binary attachment.
The body of the email is the following:

   • %original sender% wrote:
     ====
     %original body%
     ====
     %sender's domain% account auto-reply

      If you can keep your head when all about you
      Are losing theirs and blaming it on you;
      If you can trust yourself when all men doubt you,
      But make allowance for their doubting too;
      If you can wait and not be tired by waiting,
      Or, being lied about,don't deal in lies,
      Or, being hated, don't give way to hating,
      And yet don't look too good, nor talk too wise;
      ... ... more look to the attachment.

      > Get your FREE %sender's domain% now! <

Attachment:
The filename of the attachment is one of the following:
   • the hardcore game-.pif
   • Sex in Office.rm.scr
   • Deutsch BloodPatch!.exe
   • s3msong.MP3.pif
   • Me_nude.AVI.pif
   • How to Crack all gamez.exe
   • Macromedia Flash.scr
   • SETUP.EXE
   • Shakira.zip.exe
   • dreamweaver MX (crack).exe
   • StarWars2 - CloneAttack.rm.scr
   • Industry Giant II.exe
   • DSL Modem Uncapper.rar.exe
   • joke.pif
   • Britney spears nude.exe.txt.exe
   • I am For u.doc.exe
The filename of the attachment is constructed out of the following:

– It starts with one of the following:
   • body
   • message
   • test
   • data
   • file
   • text
   • doc
   • readme
   • document
   • %random character string%

    The file extension is one of the following:
   • bat
   • cmd
   • exe
   • scr
   • pif
   • zip

The attachment is a copy of the malware itself.

The attachment is an archive containing a copy of the malware itself.

The email looks like the following:

Mailing Search addresses:
It searches the following files for email addresses:
   • wab
   • adb
   • tbb
   • dbx
   • asp
   • php
   • sht
   • htm
   • txt
   • tmp

Address generation for TO and FROM fields:
To generate addresses it uses the following strings:
   • sandra; linda; julie; jimmy; jerry; helen; debby; claudia; brenda;
      anna; brent; adam; ted; fred; jack; bill; stan; smith; steve; matt;
      dave; dan; joe; jane; bob; robert; peter; tom; ray; mary; serg; brian;
      jim; maria; leo; jose; andrew; sam; george; david; kevin; mike; james;
      michael; alex; john

It combines the result with domains that were found in files, which were previously searched for addresses.

The domain is one of the following:
   • hotmail.com
   • yahoo.com
   • msn.com
   • aol.com

Avoid addresses:
It does not send emails to addresses containing one of the following strings:
   • accoun; certific; listserv; ntivi; support; icrosoft; admin; page;
      the.bat; gold-certs; feste; submit; not; help; service; privacy;
      somebody; soft; contact; site; rating; bugs; you; your; someone;
      anyone; nothing; nobody; noone; webmaster; postmaster; samples; info;
      root; mozilla; utgers.ed; tanford.e; pgp; acketst; secur; isc.o;
      isi.e; ripe.; arin.; sendmail; rfc-ed; ietf; iana; usenet; fido;
      linux; kernel; google; ibm.com; fsf.; gnu; mit.e; bsd; math; unix;
      berkeley; foo.; .mil; gov.; .gov; ruslis; nodomai; mydomai; example;
      inpris; borlan; sopho; panda; icrosof; syma; avp; .edu; -._!; -._!@;
      abuse; www; be_loyal:

Prepend MX strings:
In order to get the IP address of the mail server it has the ability to prepend the following strings to the domain name:
   • gate.
   • ns.
   • relay.
   • mail1.
   • mxs.
   • mx1.
   • smtp.
   • mail.
   • mx.

P2P In order to infect other systems in the Peer to Peer network community the following action is performed: It searches for all shared directories.

   If successful, the following files are created:
   • Thank you.doc.exe; 3D Flash Animator.rar.bat; SWF Browser2.93.txt.exe;
      Download.exe; Panda Crack.zip.exe; WinRAR V3.2.0 Beta 2.exe;
      Swish2.00.pif; AAdobe Photoshop7.0 creak.pif; You_Life.JPG.pif;
      CloneCD crack.exe; WinZip v9.0 Beta Build 5480 crack.exe; Real-DRAW
      PRO v3.10.exe; Star Wars Downloader.exe; HyperSnap-DX v5.20.01.exe;
      Adobe Photoshop6.0.zip.exe; HyperSnap-DX v4.51.01.exe

   These files are copies of the malware itself.

Network Infection In order to ensure its propagation the malware attemps to connect to other machines as described below.

It drops a copy of itself to the following network share:
   • admin$\system32

It uses the following login information in order to gain access to the remote machine:

– The following list of usernames:
   • Guest
   • Administrator

– The following list of passwords:
   • zxcv; yxcv; xxx; win; test123; test; temp123; temp; sybase; super;
      sex; secret; pwd; pw123; Password; owner; oracle; mypc123; mypc;
      mypass123; mypass; love; login; Login; Internet; home; godblessyou;
      god; enable; database; computer; alpha; admin123; Admin; abcd; aaa;
      88888888; 2600; 2004; 2003; 123asd; 123abc; 123456789; 1234567;
      123123; 121212; 11111111; 110; 007; 00000000; 000000; pass; 54321;
      12345; password; passwd; server; sql; !@; $%^&*; !@; $%^&; !@; $%^;
      !@; $%; asdfgh; asdf; !@; $; 1234; 111; root; abc123; 12345678;
      abcdefg; abcdef; abc; 888888; 666666; 111111; admin; administrator;
      guest; 654321; 123456

Process termination Processes with one of the following strings are terminated:
• RISING; SKYNET; SYMANTEC; MCAFEE; GATE; RFW.EXE; RAVMON.EXE; KILL;
NAV; DUBA; KAV

Backdoor The following port is opened:

– %malware execution directory%\%executed file% on a random TCP port in order to provide backdoor capabilities.

File details Programming language:
The malware program was written in MS Visual C++.

Runtime packer:
In order to aggravate detection and reduce size of the file it is packed with a runtime packer.

See a brief description here.

Description inserted by Irina Boldea on Mon, 23 Oct 2006 16:41 (GMT+1)
Description updated by Irina Boldea on Mon, 06 Nov 2006 11:41 (GMT+1)

» About Malware
» About Phishing
» Viruses In the Wild

« back