Worm/Piggi.B - Worm

Vedi anche

In breve

Descrizione completa

Statistiche

Nome del virus:	Worm/Piggi.B
Scoperto:	06/03/2007
Tipo:	Worm
In circolazione (ITW):	No
Numero delle infezioni segnalate:	Basso
Potenziale di propagazione:	Medio-Alto
Potenziale di danni:	Medio
File statico:	Si
Dimensione del file:	73.216 Byte
Somma di controllo MD5:	021733db8aac0B2d7df515eed3507c05
Versione VDF:	6.37.01.198
Versione IVDF:	6.37.01.204

Generale Metodi di propagazione:
   • Email
   • Rete locale

Alias:
   • Kaspersky: Trojan-Dropper.Win32.Agent.baw
   • F-Secure: Trojan-Dropper.Win32.Agent.baw
   • Eset: Win32/Piggi.NAA

Piattaforme / Sistemi operativi:
   • Windows NT
   • Windows 2000
   • Windows XP
   • Windows 2003

Effetti secondari:
   • Disattiva le applicazioni di sicurezza
   • Duplica file “maligni”
   • Utilizza un proprio motore SMTP per l'invio di email
   • Abbassa le impostazioni di sicurezza
   • Modifica del registro
   • Sfrutta la vulnerabilità del software

File Si copia alle seguenti posizioni:
• %SYSDIR%\svchost.exe:svchost.exe
• %SYSDIR%\dllcahce\svchost.exe:svchost.exe

Sovrascrive i seguenti file.
– %PROGRAM FILES%\Symantec\LiveUpdate\AUPDATE.EXE
– %PROGRAM FILES%\Symantec\LiveUpdate\LUALL.EXE
– %PROGRAM FILES%\McAfee.com\Agent\mcupdate.exe

Vengono creati i seguenti file:

– %SYSDIR%\msfsr.sys Ulteriori analisi hanno accertato che questo file è anch'esso un malware. Riconosciuto come: TR/Drop.Agent.baw

– %SYSDIR%\drivers\%stringa di caratteri casuale%.sys Ulteriori analisi hanno accertato che questo file è anch'esso un malware. Riconosciuto come: Worm/Piggi.A

Registro Le seguenti chiavi di registro sono aggiunte continuamente in un loop infinito, con lo scopo di eseguire il processo dopo il riavvio.

– [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
   • "SvcHost"="%SYSDIR%\svchost.exe:svchost.exe"
   • "reeipods"="%directory di esecuzione del malware%"

Crea la seguente riga con lo scopo di bypassare il firewall di Windows XP:

– [HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\
   FirewallPolicy\StandardProfile\AuthorizedApplications\List]
   • "%directory di esecuzione del malware%\%file
      eseguiti%"="%directory di esecuzione del malware%\%file
      eseguiti%:*:enabled:@xpsp2res.dll,-22019"

Email Contiene un motore SMTP integrato per inviare le email. Verrà stabilita una connessione diretta con il server di destinazione. Le caratteristiche sono descritte di seguito:

Da:
L'indirizzo del mittente è falso.

A:
– Indirizzi email trovati in specifici file sul sistema.
– Indirizzi email raccolti da WAB (Windows Address Book)

Oggetto:
Il seguente:
   • Your hidden site, Your hidden website, You site, Your site, Your
      website, Poker, Poker technique, Poker strategy, Online poker, Gaming,
      Online gaming, Online casino, Casino, Myspace, Myspace details, Your
      myspace details, Look at this!, Screensaver attached, Movie attached,
      Video attached, Free game downloader attached, Play this, Free game
      attached, Game attached, Listen to this!, Listen to the attachment,
      Your speech attached, Your voice attached, Your mix attached, Your
      tune attached, Your YouTube movie attached, Your YouTube video
      attached, Your movie attached, Your video attached, Free - just open
      the attachment!, Free gift, Free offer, Free - See the attachment!,
      Free!, You attached!, Your photo attached, Your picture attached, Look
      at the attachment, Open this attachment, See the attachment, An
      important message, yousite, yoursite, yourwebsite, Tekken, Indiana
      Jones 4, Hilary Duff, Carmen Electra, Jessica Alba, Jennifer Lopez,
      Jessica Simpson, Angelina Jolie, Britney Spears, Paris Hilton, Pamela
      Anderson, Dragonball, Terminator 4, Alien vs. Predator 2, Resident
      Evil 3, Rush Hour 3, Live Free or Die Hard, Spider-Man 3, Premonition,
      The Hills Have Eyes II, Ghost Rider, Heroes season 2, Smith season 2,
      Shark season 2, Jericho season 2, Studio 60 on the Sunset Strip season
      2, Six Degrees season 2, CSI: London, Grey's Anatomy - next season,
      Lost season 4, details, msg, message, document, attachment, letter,
      text, mail transcript, instructions, readme, poker, pokertechnique,
      pokerstrategy, onlinepoker, gaming, onlinegaming, onlinecasino,
      casino, myspace, myspacedetails, yourmyspacedetails, your tax returns,
      your financial information, your financial details, your bank account
      details, your SSN, etc, your personal information, your personal
      details, Dungeons & Dragons, Online: Stormreach Pursuit Force, Auto
      Assault, Metal Gear: Subsistence, Extreme Ghouls n' Ghosts, Full Auto,
      Starcraft: Ghost Huxley, Splinter Cell: Double Agent, Halo 3, Star
      Trek: Legacy, Rainbow Six: Vegas, Final Fantasy XIII, Resident Evil 5,
      Resistance: Fall of Man, Assassin’s Creed, Virtua Fighter 5, Full
      Auto 2: Battlelines, Killzone, PS3, Crysis Warhammer, Online, Age Of
      Reckoning, Command & Conquer 3: Tiberium Wars, Hellgate: London Prey,
      Unreal Tournament 2007, Ghost Recon: Advanced Warfighter, Spore,
      BioShock, Half-Life 2: Aftermath, Star Wars: Empire at War, Enemy
      Territory: Quake Wars, Neverwinter Nights 2

Corpo dell'email:
Il corpo dell’email è come uno dei seguenti:

   • Hi

     You gotta play this.

     The attached file will install the full game.

   • Hi
     You have to see it to believe it!
     --------------------------------------------------------------------------------
     Attachment: No Virus found.
     Scanned by Norton AntiVirus - symantec.com

   • Hi,
     We discovered this clip of you on a web site. You should hear it immediately.

   • Hi
     We discovered this movie of you on YouTube. You have to open it straight away.

   • Hi %Nome utente dell'account email%,
     You gotta play Resistance: Fall of Man (unreleased).
     The attached file will download the full game.
     This is completely free.

   • Hi %Nome utente dell'account email%,
     I found your personal details on the net.
     It looks like somebody has hijacked your computer and posted the attached file.
     You need to check the details in the attachment to see if they are genuine.

   • Hi
     I found this picture (attached) of you on the net. I think you should open it right now.

   • Hello %Nome utente dell'account email%,
     We saw this image (attached) of you on Flickr. You should open it immediately.

   • Hi %Nome utente dell'account email%,
     Somebody has broken into your MySpace account.
     You should verify the details in the attachment to see if they are real.

   • Hi
     I saw this image (attached) of you on somebody's blog. I think you should open it immediately.

   • Hi %Nome utente dell'account email%,
     I found a never seen before clip of Six Degrees season 2 (attached).
     You have to see it to believe it.

   • I heard this tape of you on somebody's blog. You have to listen to it right now.

   • Hi
     We saw this amazing free offer on the net.
     A brand new Creative Zen V Plus for free.
     Just open the attachment for details.

   • Hi %Nome utente dell'account email%,
     You might like to play Star Trek: Legacy (unreleased).
     The attached file will download the rest of the game.
     This is completely free.

   • Our records indicate that you have not updated your McAfee products recently.
     The attached file contains a cumulative rollup of security fixes necessary to help keep your computer safe.
     Please install it immediately by opening the attachment.
     McAfee Customer Support Team.
     McAfee.com

   • Hi
     Unbeatable Poker strategy.
     Just open the attachment for details.
     ________________________________

     ++ Attachment: No Virus found.
     ++ McAfee AntiVirus - mcafee.com
     ________________________________

   • Our records indicate that you have not updated your Microsoft products recently.
     The attached file contains a cumulative rollup of security fixes necessary to help keep your computer safe.
     Please install it immediately by opening the attachment.
     Microsoft Customer Support Team.
     Microsoft.com
     --------------------------------------------------------------------------------
     Attachment: No Virus found.

File allegato:
I nomi dei file allegati vengono estrapolati dai seguenti:

   • yourhiddensite
   • hiddensite
   • yousite
   • yoursite
   • yourwebsite
   • Tekken
   • Indiana Jones 4
   • Hilary Duff
   • Carmen Electra
   • Jessica Alba
   • Jennifer Lopez
   • Jessica Simpson
   • Angelina Jolie
   • Britney Spears
   • Paris Hilton
   • Pamela Anderson
   • Dragonball
   • Terminator 4
   • Alien vs. Predator 2
   • Resident Evil 3
   • Rush Hour 3
   • Live Free or Die Hard
   • Spider-Man 3
   • Premonition
   • The Hills Have Eyes II
   • Ghost Rider
   • Heroes season 2
   • Smith season 2
   • Shark season 2
   • Jericho season 2
   • Studio 60 on the Sunset Strip season 2
   • Six Degrees season 2
   • CSI: London
   • Grey's Anatomy - next season
   • Lost season 4
   • details
   • message
   • document
   • attachment
   • letter
   • transcript
   • instructions
   • readme
   • poker
   • pokertechnique
   • pokerstrategy
   • onlinepoker
   • gaming
   • onlinegaming
   • onlinecasino
   • casino
   • myspace
   • myspacedetails
   • yourmyspacedetails
   • your tax returns
   • your financial information
   • your financial details
   • your bank account details
   • your SSN etc
   • your personal information
   • your personal details
   • Dungeons & Dragons Online: Stormreach
   • Pursuit Force
   • Auto Assault
   • Metal Gear: Subsistence
   • Extreme Ghouls n' Ghosts
   • Full Auto
   • Starcraft: Ghost
   • Huxley
   • Splinter Cell: Double Agent
   • Halo 3
   • Star Trek: Legacy
   • Rainbow Six: Vegas
   • Final Fantasy XIII
   • Resident Evil 5
   • Resistance: Fall of Man
   • Assassin
   • s Creed
   • Virtua Fighter 5
   • Full Auto 2: Battlelines
   • Killzone PS3
   • Crysis
   • Warhammer Online Age Of Reckoning
   • Command & Conquer 3: Tiberium Wars
   • Hellgate: London
   • Unreal Tournament 2007
   • Ghost Recon: Advanced Warfighter
   • Spore
   • BioShock
   • Half-Life 2: Aftermath
   • Star Wars: Empire at War
   • Enemy Territory: Quake Wars
   • Neverwinter Nights 2
   • youtube-you

    A volte seguito da una delle seguenti false estensioni oltre che da vari spazi vuoti:
   • .wav
   • .wma
   • .mp3
   • .rtf
   • .html
   • .txt
   • .gif
   • .jpeg

    L'estensione del file è una delle seguenti:
   • scr
   • pif
   • exe
   • bat
   • cmd
   • com

Qui ci sono alcuni esempi di come il nome del file allegato potrebbe presentarsi:
   • Rainbow Six_Vegas.exe
   • you.scr
   • Mc Afee update.exe
   • yousite.com
   • myspace.txt.pif

L'allegato è una copia del malware stesso.

L'email può presentarsi come una delle seguenti:

Invio di messaggi Cerca indirizzi:
Cerca il seguente file per gli indirizzi email:
   • vbc, snm, smd, pst, pop, pmx, ply, nsf, na2, mmf, mlm, ldb, imc, imb,
      iaf, gup, gdb, gam, dvc, dld, clb, cdm, cat, pab, edb, btx, btr, brk,
      md, mb, bk, blt, adr, bib, bgt, bcn, bcm, bag, vcf, map, log, jav,
      nws, mht, wsh, vbs, uin, rtf, oft, js, eml, doc, dht, cgi, pdf, xsl,
      xml, sql, csv, tex, css, pl, adb, tbb, db, asp, php, sht, ht, txt

“Infezione” della rete Exploit:
Sfrutta le seguenti vulnerabilità:
– MS04-007 (ASN.1 Vulnerability)
–MS06-040 (Vulnerability in Server Service)

Generazione dell'indirizzo IP:
Crea degli indirizzi IP casuali e prova a stabilire una connessione.

Processi terminati I seguenti servizi vengono disattivati:
   • sharedaccess
   • wscsvc
   • lanmanserver
   • Browser
   • SymAppCore
   • navapsvc
   • McShield

Varie Collegamento a internet:
Per verificare la propria connessione internet, viene contattato il seguente server DNS:
• A.ROOT-SERVERS.NET

Verifica la presenza di una connessione ad internet contattando il seguente sito web:
• www.mi5.gov.uk

Tecnologia Rootkit Nasconde il seguente:
– I propri file
– I propri processi

Metodo utilizzato:
• Nascosto dalle Windows API

Dettagli del file Software di compressione:
Per complicarne l'individuazione e ridurre la dimensione del file, viene compresso con un software di compressione.

Per la descrizione "in breve" clicca qui.

Descrizione inserita da Ernest Szocs il Tue, 06 Mar 2007 13:59 (GMT+1)
Descrizione aggiornata da Ernest Szocs il Wed, 07 Mar 2007 13:00 (GMT+1)

» About Malware
» About Phishing
» Viruses In the Wild

« Indietro