Worm/Piggi.B - Worm

See also

Summary

Full description

Statistics

Virus:	Worm/Piggi.B
Date discovered:	06/03/2007
Type:	Worm
In the wild:	No
Reported Infections:	Low
Distribution Potential:	Medium to high
Damage Potential:	Medium
Static file:	Yes
File size:	73.216 Bytes
MD5 checksum:	021733db8aac0B2d7df515eed3507c05
VDF version:	6.37.01.198
IVDF version:	6.37.01.204 - Tue, 06 Mar 2007 11:46 (GMT+1)

General Methods of propagation:
   • Email
   • Local network

Aliases:
   • Kaspersky: Trojan-Dropper.Win32.Agent.baw
   • F-Secure: Trojan-Dropper.Win32.Agent.baw
   • Eset: Win32/Piggi.NAA

Platforms / OS:
   • Windows NT
   • Windows 2000
   • Windows XP
   • Windows 2003

Side effects:
   • Disable security applications
   • Drops malicious files
   • Uses its own Email engine
   • Lowers security settings
   • Registry modification
   • Makes use of software vulnerability

Files It copies itself to the following locations:
• %SYSDIR%\svchost.exe:svchost.exe
• %SYSDIR%\dllcahce\svchost.exe:svchost.exe

It overwrites the following files.
– %PROGRAM FILES%\Symantec\LiveUpdate\AUPDATE.EXE
– %PROGRAM FILES%\Symantec\LiveUpdate\LUALL.EXE
– %PROGRAM FILES%\McAfee.com\Agent\mcupdate.exe

The following files are created:

– %SYSDIR%\msfsr.sys Further investigation pointed out that this file is malware, too. Detected as: TR/Drop.Agent.baw

– %SYSDIR%\drivers\%random character string%.sys Further investigation pointed out that this file is malware, too. Detected as: Worm/Piggi.A

Registry The following registry keys are continuously in an infinite loop added in order to run the processes after reboot.

– [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
   • "SvcHost"="%SYSDIR%\svchost.exe:svchost.exe"
   • "reeipods"="%malware execution directory%"

It creates the following entry in order to bypass the Windows XP firewall:

– [HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\
   FirewallPolicy\StandardProfile\AuthorizedApplications\List]
   • "%malware execution directory%\%executed
      file%"="%malware execution directory%\%executed
      file%:*:enabled:@xpsp2res.dll,-22019"

Email It contains an integrated SMTP engine in order to send emails. A direct connection with the destination server will be established. The characteristics are described in the following:

From:
The sender address is spoofed.

To:
– Email addresses found in specific files on the system.
– Email addresses gathered from WAB (Windows Address Book)

Subject:
The following:
   • Your hidden site, Your hidden website, You site, Your site, Your
      website, Poker, Poker technique, Poker strategy, Online poker, Gaming,
      Online gaming, Online casino, Casino, Myspace, Myspace details, Your
      myspace details, Look at this!, Screensaver attached, Movie attached,
      Video attached, Free game downloader attached, Play this, Free game
      attached, Game attached, Listen to this!, Listen to the attachment,
      Your speech attached, Your voice attached, Your mix attached, Your
      tune attached, Your YouTube movie attached, Your YouTube video
      attached, Your movie attached, Your video attached, Free - just open
      the attachment!, Free gift, Free offer, Free - See the attachment!,
      Free!, You attached!, Your photo attached, Your picture attached, Look
      at the attachment, Open this attachment, See the attachment, An
      important message, yousite, yoursite, yourwebsite, Tekken, Indiana
      Jones 4, Hilary Duff, Carmen Electra, Jessica Alba, Jennifer Lopez,
      Jessica Simpson, Angelina Jolie, Britney Spears, Paris Hilton, Pamela
      Anderson, Dragonball, Terminator 4, Alien vs. Predator 2, Resident
      Evil 3, Rush Hour 3, Live Free or Die Hard, Spider-Man 3, Premonition,
      The Hills Have Eyes II, Ghost Rider, Heroes season 2, Smith season 2,
      Shark season 2, Jericho season 2, Studio 60 on the Sunset Strip season
      2, Six Degrees season 2, CSI: London, Grey's Anatomy - next season,
      Lost season 4, details, msg, message, document, attachment, letter,
      text, mail transcript, instructions, readme, poker, pokertechnique,
      pokerstrategy, onlinepoker, gaming, onlinegaming, onlinecasino,
      casino, myspace, myspacedetails, yourmyspacedetails, your tax returns,
      your financial information, your financial details, your bank account
      details, your SSN, etc, your personal information, your personal
      details, Dungeons & Dragons, Online: Stormreach Pursuit Force, Auto
      Assault, Metal Gear: Subsistence, Extreme Ghouls n' Ghosts, Full Auto,
      Starcraft: Ghost Huxley, Splinter Cell: Double Agent, Halo 3, Star
      Trek: Legacy, Rainbow Six: Vegas, Final Fantasy XIII, Resident Evil 5,
      Resistance: Fall of Man, Assassin’s Creed, Virtua Fighter 5, Full
      Auto 2: Battlelines, Killzone, PS3, Crysis Warhammer, Online, Age Of
      Reckoning, Command & Conquer 3: Tiberium Wars, Hellgate: London Prey,
      Unreal Tournament 2007, Ghost Recon: Advanced Warfighter, Spore,
      BioShock, Half-Life 2: Aftermath, Star Wars: Empire at War, Enemy
      Territory: Quake Wars, Neverwinter Nights 2

Body:
The body of the email is one of the following:

   • Hi

     You gotta play this.

     The attached file will install the full game.

   • Hi
     You have to see it to believe it!
     --------------------------------------------------------------------------------
     Attachment: No Virus found.
     Scanned by Norton AntiVirus - symantec.com

   • Hi,
     We discovered this clip of you on a web site. You should hear it immediately.

   • Hi
     We discovered this movie of you on YouTube. You have to open it straight away.

   • Hi %email account's user name%,
     You gotta play Resistance: Fall of Man (unreleased).
     The attached file will download the full game.
     This is completely free.

   • Hi %email account's user name%,
     I found your personal details on the net.
     It looks like somebody has hijacked your computer and posted the attached file.
     You need to check the details in the attachment to see if they are genuine.

   • Hi
     I found this picture (attached) of you on the net. I think you should open it right now.

   • Hello %email account's user name%,
     We saw this image (attached) of you on Flickr. You should open it immediately.

   • Hi %email account's user name%,
     Somebody has broken into your MySpace account.
     You should verify the details in the attachment to see if they are real.

   • Hi
     I saw this image (attached) of you on somebody's blog. I think you should open it immediately.

   • Hi %email account's user name%,
     I found a never seen before clip of Six Degrees season 2 (attached).
     You have to see it to believe it.

   • I heard this tape of you on somebody's blog. You have to listen to it right now.

   • Hi
     We saw this amazing free offer on the net.
     A brand new Creative Zen V Plus for free.
     Just open the attachment for details.

   • Hi %email account's user name%,
     You might like to play Star Trek: Legacy (unreleased).
     The attached file will download the rest of the game.
     This is completely free.

   • Our records indicate that you have not updated your McAfee products recently.
     The attached file contains a cumulative rollup of security fixes necessary to help keep your computer safe.
     Please install it immediately by opening the attachment.
     McAfee Customer Support Team.
     McAfee.com

   • Hi
     Unbeatable Poker strategy.
     Just open the attachment for details.
     ________________________________

     ++ Attachment: No Virus found.
     ++ McAfee AntiVirus - mcafee.com
     ________________________________

   • Our records indicate that you have not updated your Microsoft products recently.
     The attached file contains a cumulative rollup of security fixes necessary to help keep your computer safe.
     Please install it immediately by opening the attachment.
     Microsoft Customer Support Team.
     Microsoft.com
     --------------------------------------------------------------------------------
     Attachment: No Virus found.

Attachment:
The filenames of the attachments is constructed out of the following:

   • yourhiddensite
   • hiddensite
   • yousite
   • yoursite
   • yourwebsite
   • Tekken
   • Indiana Jones 4
   • Hilary Duff
   • Carmen Electra
   • Jessica Alba
   • Jennifer Lopez
   • Jessica Simpson
   • Angelina Jolie
   • Britney Spears
   • Paris Hilton
   • Pamela Anderson
   • Dragonball
   • Terminator 4
   • Alien vs. Predator 2
   • Resident Evil 3
   • Rush Hour 3
   • Live Free or Die Hard
   • Spider-Man 3
   • Premonition
   • The Hills Have Eyes II
   • Ghost Rider
   • Heroes season 2
   • Smith season 2
   • Shark season 2
   • Jericho season 2
   • Studio 60 on the Sunset Strip season 2
   • Six Degrees season 2
   • CSI: London
   • Grey's Anatomy - next season
   • Lost season 4
   • details
   • message
   • document
   • attachment
   • letter
   • transcript
   • instructions
   • readme
   • poker
   • pokertechnique
   • pokerstrategy
   • onlinepoker
   • gaming
   • onlinegaming
   • onlinecasino
   • casino
   • myspace
   • myspacedetails
   • yourmyspacedetails
   • your tax returns
   • your financial information
   • your financial details
   • your bank account details
   • your SSN etc
   • your personal information
   • your personal details
   • Dungeons & Dragons Online: Stormreach
   • Pursuit Force
   • Auto Assault
   • Metal Gear: Subsistence
   • Extreme Ghouls n' Ghosts
   • Full Auto
   • Starcraft: Ghost
   • Huxley
   • Splinter Cell: Double Agent
   • Halo 3
   • Star Trek: Legacy
   • Rainbow Six: Vegas
   • Final Fantasy XIII
   • Resident Evil 5
   • Resistance: Fall of Man
   • Assassin
   • s Creed
   • Virtua Fighter 5
   • Full Auto 2: Battlelines
   • Killzone PS3
   • Crysis
   • Warhammer Online Age Of Reckoning
   • Command & Conquer 3: Tiberium Wars
   • Hellgate: London
   • Unreal Tournament 2007
   • Ghost Recon: Advanced Warfighter
   • Spore
   • BioShock
   • Half-Life 2: Aftermath
   • Star Wars: Empire at War
   • Enemy Territory: Quake Wars
   • Neverwinter Nights 2
   • youtube-you

    Sometimes continued by one of the following fake extensions in addition to several empty spaces:
   • .wav
   • .wma
   • .mp3
   • .rtf
   • .html
   • .txt
   • .gif
   • .jpeg

    The file extension is one of the following:
   • scr
   • pif
   • exe
   • bat
   • cmd
   • com

Here are a few examples of how the filename of the attachment might look like:
   • Rainbow Six_Vegas.exe
   • you.scr
   • Mc Afee update.exe
   • yousite.com
   • myspace.txt.pif

The attachment is a copy of the malware itself.

The email may look like one of the following:

Mailing Search addresses:
It searches the following file for email addresses:
   • vbc, snm, smd, pst, pop, pmx, ply, nsf, na2, mmf, mlm, ldb, imc, imb,
      iaf, gup, gdb, gam, dvc, dld, clb, cdm, cat, pab, edb, btx, btr, brk,
      md, mb, bk, blt, adr, bib, bgt, bcn, bcm, bag, vcf, map, log, jav,
      nws, mht, wsh, vbs, uin, rtf, oft, js, eml, doc, dht, cgi, pdf, xsl,
      xml, sql, csv, tex, css, pl, adb, tbb, db, asp, php, sht, ht, txt

Network Infection Exploit:
It makes use of the following Exploits:
– MS04-007 (ASN.1 Vulnerability)
–MS06-040 (Vulnerability in Server Service)

IP address generation:
It creates random IP addresses and tries to establish a connection with them.

Process termination List of services that are disabled:
   • sharedaccess
   • wscsvc
   • lanmanserver
   • Browser
   • SymAppCore
   • navapsvc
   • McShield

Miscellaneous Internet connection:
In order to check for its internet connection the following DNS server is contacted:
• A.ROOT-SERVERS.NET

Checks for an internet connection by contacting the following web site:
• www.mi5.gov.uk

Rootkit Technology Hides the following:
– Its own files
– Its own processes

Method used:
• Hidden from Windows API

File details Runtime packer:
In order to aggravate detection and reduce size of the file it is packed with a runtime packer.

See a brief description here.

Description inserted by Ernest Szocs on Tue, 06 Mar 2007 13:59 (GMT+1)
Description updated by Ernest Szocs on Wed, 07 Mar 2007 13:00 (GMT+1)

» About Malware
» About Phishing
» Viruses In the Wild

« back