Nome del virus:Worm/Netsky.HB
Scoperto:10/09/2007
Tipo:Worm
In circolazione (ITW):Si
Numero delle infezioni segnalate:Medio-Alto
Potenziale di propagazione:Medio-Alto
Potenziale di danni:Basso
File statico:No
Dimensione del file:~31.000 Byte
Versione VDF:6.39.1.107
Versione IVDF:6.39.01.110 - lunedì 10 settembre 2007

 Generale Metodi di propagazione:
   • Email
   • Peer to Peer


Alias:
   •  Mcafee: W32/Netsky.p@MM
   •  Kaspersky: Email-Worm.Win32.NetSky.q
   •  Grisoft: I-Worm/Netsky.Q
   •  VirusBuster: I-Worm.Netsky.P!Dam
   •  Eset: Win32/Netsky.Q
   •  Bitdefender: Win32.Netsky.P@mm


Piattaforme / Sistemi operativi:
   • Windows 95
   • Windows 98
   • Windows 98 SE
   • Windows NT
   • Windows ME
   • Windows 2000
   • Windows XP
   • Windows 2003


Effetti secondari:
   • Duplica file “maligni”
   • Utilizza un proprio motore SMTP per l'invio di email
   • Modifica del registro

 File Si copia alla seguente posizione:
   • %WINDIR%\FVProtect.exe



Vengono creati i seguenti file:

– Crea il seguente archivio contenente una copia del malware:
   • %WINDIR%\zipped.tmp

– Copie di se stesso con codifica MIME:
   • %WINDIR%\zip1.tmp
   • %WINDIR%\zip2.tmp
   • %WINDIR%\zip3.tmp
   • %WINDIR%\base64.tmp

– %WINDIR%\userconfig9x.dll Ulteriori analisi hanno accertato che questo file è anch'esso un malware. Riconosciuto come: WORM/Netsky.P.2

 Registro Viene aggiunta nel registro la seguente chiave con lo scopo di eseguire il processo dopo il riavvio:

– [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
   • Norton Antivirus AV="%WINDIR%\FVProtect.exe"



I valori della seguente chiave di registro vengono rimossi:

–  [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
   • Explorer
   • system
   • msgsvr32
   • winupd.exe
   • direct.exe
   • jijbl
   • Video
   • service
   • DELETE ME
   • Sentry
   • Taskmon
   • Windows Services Host

–  [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
   • Explorer
   • au.exe
   • direct.exe
   • d3dupdate.exe
   • OLE
   • gouday.exe
   • rate.exe
   • Taskmon
   • Windows Services Host
   • sysmon.exe
   • srate.exe
   • ssate.exe
   • winupd.exe

–  [HKCR\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InProcServer32]

 Email Contiene un motore SMTP integrato per inviare le email. Verrà stabilita una connessione diretta con il server di destinazione. Le caratteristiche sono descritte di seguito:


Da:
L'indirizzo del mittente è falso.
Indirizzi generati. Non si presupponga che fosse intenzione del mittente inviare questa email. Potrebbe non essere a conoscenza della propria ”infezione” o addirittura potrebbe non essere “infetto”. In più si potrebbero ricevere email bounce che diranno che si è “infetti”. Questo potrebbe comunque non essere il caso.


A:
– Indirizzi email trovati in specifici file sul sistema.
– Indirizzi generati


Oggetto:
Uno dei seguenti:
   • Administrator; approved letter; approved message; Congratulations!; Do
      you?; Does it matter?; Error; excel document; Fwd: Warning again;
      Hello; hi; I cannot forget you!; I love you!; Illegal Website;
      important; Important m$6h?3p; improved; Information; Internet Provider
      Abuse; Is that your password?; letter; Mail Account; Mail
      Authentication; Mail Delivery (failure); my application; my file; my
      text; my website; News; Notice again; Postcard; Private document;
      product; Protected Mail System; Re: A!p$ghsa; Re: Administration; Re:
      application; Re: approved; Re: approved application; Re: approved
      details; Re: Approved document; Re: approved letter; Re: Bad Request;
      Re: corrected; Re: data; Re: Delivery Protection; Re: Delivery Server;
      Re: details; Re: Developement; Re: Encrypted Mail; Re: Error; Re:
      Error in document; Re: excel document; Re: Extended Mail; Re: Extended
      Mail System; Re: Failure; Re: Free porn; Re: Hello; Re: here; Re: hi;
      Re: important; Re: important excel document; Re: important file; Re:
      important product; Re: important website; Re: important word document;
      Re: improved; Re: information; Re: Is that your document?; Re: Its me;
      Re: List; Re: Mail Authentification; Re: Mail Server; Re: Message; Re:
      Message Error; Re: my details; Re: Notify; Re: Old photos; Re: Old
      times; Re: Order; Re: patched; Re: Proof of concept; Re: Protected
      Mail Delivery; Re: Protected Mail System; Re: Question; Re: Re: bill;
      Re: Re: corrected; Re: Re: details; Re: Re: important; Re: Re:
      information; Re: Re: read it immediately; Re: Re: thanks!; Re: read it
      immediately; Re: Request; Re: Sample; Re: Secure delivery; Re: Secure
      SMTP Message; Re: Sex pictures; Re: SMTP Server; Re: Status; Re:
      Submit a Virus Sample; Re: Test; Re: text; Re: Thank you for delivery;
      Re: thanks!; Re: Virus Sample; Re: website; Re: your bill; Re: Your
      document; Re: your excel document; Re: your letter; Shocking document;
      Spam; Spamed?; Stolen document; thanks!; word document; You cannot do
      that!; Your day; %stringa di caratteri casuale%

In alcuni casi l'oggetto può anche essere vuoto.


Corpo dell'email:
Il corpo dell’email è come uno dei seguenti:

   • Please see the attached file for details
     Please read the attached file!
     Your document is attached.
     Please read the document.
     Your file is attached.
     Your document is attached.
     Please confirm the document.
     Please read the important document.
     See the file.
     Requested file.
     Authentication required.
     Your document is attached to this mail.
     I have attached your document.
     I have received your document. The corrected document is attached.
     Your document.
     Your details.
     Please confirm!
     Please answer quickly!
     Thank you for your request, your details are attached!
     Thanks!
     am shocked about your document!
     Let'us be short: you have no experience in writing letters!!!
     Try this, or nothing!
     Here is it!
     Do not visit this illegal websites!
     You have downloaded these illegal cracks?
     Here is my icq list.
     Here is my phone number.
     I have visited this website and I found you in the spammer list. Is that true?
     Are you a spammer? (I found your email on a spammer website!?!)
     po44u90ugjid-k9z5894z0
     9u049u89gh89fsdpokofkdpbm3-4i
     Please r564g!he4a56a3haafdogu mfn3o SMTP Error 201
     Server Error 203
     See the ghg5%&6gfz65!4Hf55d!46gfgf
     Your photo, uahhh.... , you are naked!
     You have written a very good text, excellent, good work!
     Your archive is attached.
     Monthly news report.
     lovely, :-)
     your big love, ;-)
     I hope you accept the result!
     The sample is attached!
     Your important document, correction is finished!
     Important message, do not show this anyone!
     Here is the website. ;-)
     My favourite page.
     I have corrected your document.
     I have attached the sample.
     Your bill is attached to this mail.
     You were registered to the pay system.
     For more details see the attachment.
     Binary message is available.
     Message has been sent as a binary attachment.
     Can you confirm it?
     I have attached it to this mail.
     Please read the attached file.
     Your document is attached.
     Encrypted message is available.
     Protected message is attached.
     Please confirm my request.
     ESMTP [Secure Mail System 334]: Secure message is attached.
     Partial message is available.
     Waiting for a Response. Please read the attachment.
     First part of the secure mail is available.
     For more details see the attachment.
     For further details see the attachment.
     Your requested mail has been attached.
     Protected Mail System Test.
     Secure Mail System Beta Test.
     Forwarded message is available.
     Delivered message is attached.
     Encrypted message is available.
     Please read the attachment to get the message.
     Follow the instructions to read the message.
     Please authenticate the secure message.
     Protected message is attached.
     Waiting for authentification.
     Protected message is available.
     Bad Gateway: The message has been attached.
     SMTP: Please confirm the attached message.
     You got a new message.
     Now a new message is available.
     New message is available.
     You have received an extended message. Please read the instructions.
     I noticed that you have visited illegal websites.
     I found this document about you. I cannot believe that.
     See the name in the list!
     You have visited illegal websites.I have a big list of the websites you surfed.
     Your mail account is expired. See the details to reactivate it.
     Your mail account has been closed. For further details see the document.
     The file is protected with the password ghj001.
     I have attached your file. Your password is jkl44563.
     The sample file you sent contains a new virus version of mydoom.j.
     Please clean your system with the attached signature.
     Sincerly,
     Robert Ferrew
     Greetings from france,
     your friend.
     Have a look at these.
     Best wishes,
     your friend.
     Congratulations!,
     your best friend.
     Try this game ;-)
     I hope the patch works.


A volte seguito da uno dei seguenti:

   • +++ Attachment: No Virus found
     +++ MessageLabs AntiVirus - www.messagelabs.com
     
      +++ Attachment: No Virus found
      +++ Bitdefender AntiVirus - www.bitdefender.com
     
      +++ Attachment: No Virus found
      +++ MC-Afee AntiVirus - www.mcafee.com
     
      +++ Attachment: No Virus found
      +++ Kaspersky AntiVirus - www.kaspersky.com
     
      +++ Attachment: No Virus found
      +++ Panda AntiVirus - www.pandasoftware.com
     
      ++++ Attachment: No Virus found
      ++++ Norman AntiVirus - www.norman.com
     
      ++++ Attachment: No Virus found
      ++++ F-Secure AntiVirus - www.f-secure.com
     
      ++++ Attachment: No Virus found
      ++++ Norton AntiVirus - www.symantec


File allegato:
Il nome del file allegato è uno dei seguenti:
   • document_all
   • text
   • message
   • data
   • excel document
   • word document
   • bill
   • screensaver
   • application
   • website
   • product
   • letter
   • information
   • details
   • file
   • document
   • important
   • approved

   • .doc
   • .txt

    L'estensione del file è una delle seguenti:
   • exe
   • pif
   • scr
   • zip

L'allegato è una copia del malware stesso.



L’email si presenta come di seguito:


 Invio di messaggi Cerca indirizzi:
Cerca i seguenti file per gli indirizzi email:
   • .php; .asp; .wab; .doc; .vbs; .txt; .rtf; .uin; .shtm; .cgi; .eml;
      .dhtm; .pl; .adb; .tbb; .dbx; .sht; .oft; .msg; .htm; .html; .jsp;
      .wsh; .xml


Evita indirizzi:
Non invia email agli indirizzi che contengono una delle seguenti stringhe:
   • @antivi; @avp; @bitdefender; @fbi; @f-pro; @freeav; @f-secur;
      @kaspersky; @mcafee; @messagel; @microsof; @norman; @norton;
      @pandasof; @skynet; @sophos; @spam; @symantec; @viruslis; abuse@;
      noreply@; ntivir; reports@; spam@

 P2P Per “infettare” altri sistemi della comunità della rete Peer to Peer, viene eseguita la seguente azione:   Cerca le seguenti condivisioni standard:
   • bear
   • donkey
   • download
   • ftp
   • htdocs
   • http
   • icq
   • kazaa
   • lime
   • morpheus
   • mule
   • my shared folder
   • shar
   • shared files
   • upload

   Se riuscito, i seguenti file vengono creati:
   • Kazaa Lite 4.0 new.exe; Britney Spears Sexy archive.doc.exe; Kazaa
      new.exe; Britney Spears porn.jpg.exe; Harry Potter all e.book.doc.exe;
      Britney sex xxx.jpg.exe; Harry Potter 1-6 book.txt.exe; Britney Spears
      blowjob.jpg.exe; Harry Potter e book.doc.exe; Britney Spears
      cumshot.jpg.exe; Harry Potter.doc.exe; Britney Spears fuck.jpg.exe;
      Harry Potter game.exe; Britney Spears.jpg.exe; Harry Potter 5.mpg.exe;
      Britney Spears and Eminem porn.jpg.exe; Matrix.mpg.exe; Britney Spears
      Song text archive.doc.exe; Britney Spears full album.mp3.exe;
      Eminem.mp3.exe; Britney Spears.mp3.exe; Eminem Song text
      archive.doc.exe; Eminem Sexy archive.doc.exe; Eminem full
      album.mp3.exe; Eminem Spears porn.jpg.exe; Ringtones.mp3.exe; Eminem
      sex xxx.jpg.exe; Ringtones.doc.exe; Eminem blowjob.jpg.exe; Altkins
      Diet.doc.exe; Eminem Poster.jpg.exe; American Idol.doc.exe;
      Cloning.doc.exe; Saddam Hussein.jpg.exe; Arnold
      Schwarzenegger.jpg.exe; Windows 2003 crack.exe; Windows XP crack.exe;
      Adobe Photoshop 10 crack.exe; Microsoft WinXP Crack full.exe; Teen
      Porn 15.jpg.pif; Adobe Premiere 10.exe; Adobe Photoshop 10 full.exe;
      Best Matrix Screensaver new.scr; Porno Screensaver britney.scr; Dark
      Angels new.pif; XXX hardcore pics.jpg.exe; Microsoft Office 2003 Crack
      best.exe; Serials edition.txt.exe; Screensaver2.scr; Full album
      all.mp3.pif; Ahead Nero 8.exe; netsky source code.scr; E-Book
      Archive2.rtf.exe; Doom 3 release 2.exe; How to hack new.doc.exe; Learn
      Programming 2004.doc.exe; WinXP eBook newest.doc.exe; Win Longhorn
      re.exe; Dictionary English 2004 - France.doc.exe; RFC
      compilation.doc.exe; 1001 Sex and more.rtf.exe; 3D Studio Max 6
      3dsmax.exe; Keygen 4 all new.exe; Windows 2000 Sourcecode.doc.exe;
      Norton Antivirus 2005 beta.exe; Gimp 1.8 Full with Key.exe;
      Partitionsmagic 10 beta.exe; Star Office 9.exe; Magix Video Deluxe 5
      beta.exe; Clone DVD 6.exe; MS Service Pack 6.exe; ACDSee 10.exe;
      Visual Studio Net Crack all.exe; Cracks & Warez Archiv.exe; WinAmp 13
      full.exe; DivX 8.0 final.exe; Opera 11.exe; Internet Explorer 9
      setup.exe; Smashing the stack full.rtf.exe; Ulead Keygen 2004.exe;
      Lightwave 9 Update.exe; The Sims 4 beta.exe


 Varie Mutex:
Crea il seguente Mutex:
   • -oO]xX|-S-k-y-N-e-t-|Xx[Oo-_


Crea uno dei seguenti Mutex:
   • U'l't'i'm'a't'i'v'e 'E'n'c'r'y'p't'e'd 'W'o'r'm'D'r'o'p'p'e'r' 'b'y 'S'k'y'N'e't'.'C'Z' 'C'o'r'p*'
   • 'D'r'o'p'p'e'd'S'k'y'N'e't'
   • 'S'k'y'N'e't'F'i'g'h't's'B'a'c'k

 Dettagli del file Linguaggio di programmazione:
 Il malware è stato scritto in MS Visual C++.


Software di compressione:
Per complicarne l'individuazione e ridurre la dimensione del file, viene compresso con il seguente software di compressione:
   • FSG

Descrizione inserita da Ana Maria Niculescu su giovedì 25 ottobre 2007
Descrizione aggiornata da Ana Maria Niculescu su giovedì 25 ottobre 2007

Indietro . . . .