Worm/Sasser.F - Worm

A voir aussi

Description complète

Alias:
Type:	Worm
Size:	74,752 Bytes
Origin:	unknown
Date:	05-10-2004
Damage:	Uses LSASS security hole (Microsoft Security Bulletin MS04-011)
VDF Version:	6.25.00.60 - Wed, 12 May 2004 14:42 (GMT+1)
Danger:	Low
Distribution:	High

General DescriptionThe worm makes sure that only one version of itself is active, using a Mutex (billgate). It copies itself as %WinDIR%\napatch.exe and makes the following entry in Windows registry:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
CurrentVersion\Run
"napatch.exe"="%WinDIR%\napatch.exe"

The Lsass.exe process will be finished when the worm uses the Windows LSASS security hole. Windows sends a message and shuts the system down in a minute. The file C:\win2.log contains the IP addresses and the number of the infected computer.

Technical DetailsIt starts an FTP server over TCP Port 5554. This server is used for spreading the worm to other systems. It collects IP addresses from the infected systems and generates new IP addresses, similar to the ones it gathered.

It contacts on TCP Port 445 other systems, which did not have the LSASS security hole fixed. When connected, it sends to it a Shell Code to open the TCP Port 9996. After that, it will use TCP Port 5554 to send a copy of the worm to the clean computer. This copy has a name of 4 or 5 characters, followed by _up.exe.

Voir la description brève ici.

Description inséré par Crony Walker sur Tue, 15 Jun 2004 14:00 (GMT+1)

» About Malware
» About Phishing
» Viruses In the Wild

« Retour