Worm/Piggi.B - Worm

Ver também

Sumário

Descrição completa

Estatísticas

Vírus	Worm/Piggi.B
Data em que surgiu:	06/03/2007
Tipo:	Worm
Incluído na lista "In The Wild"	Não
Nível de danos:	Baixo
Nível de distribuição:	De médio a elevado
Nível de risco:	Médio
Ficheiro estático:	Sim
Tamanho:	73.216 Bytes
MD5 checksum:	021733db8aac0B2d7df515eed3507c05
Versão VDF:	6.37.01.198
Versão IVDF:	6.37.01.204

Vulgarmente Meios de transmissão:
   • E-mail
   • Rede local

Alias:
   • Kaspersky: Trojan-Dropper.Win32.Agent.baw
   • F-Secure: Trojan-Dropper.Win32.Agent.baw
   • Eset: Win32/Piggi.NAA

Sistemas Operativos:
   • Windows NT
   • Windows 2000
   • Windows XP
   • Windows 2003

Efeitos secundários:
   • Desactiva aplicações de segurança
   • Descarrega ficheiros maliciosos
   • Utiliza o seu próprio motor de E-mail
   • Baixa as definições de segurança
   • Altera o registo do Windows
   • Aproveita-se de vulnerabilidades do software

Ficheiros Autocopia-se para as seguintes localizações
• %SYSDIR%\svchost.exe:svchost.exe
• %SYSDIR%\dllcahce\svchost.exe:svchost.exe

Altera o conteúdo dos ficheiros seguintes.
– %PROGRAM FILES%\Symantec\LiveUpdate\AUPDATE.EXE
– %PROGRAM FILES%\Symantec\LiveUpdate\LUALL.EXE
– %PROGRAM FILES%\McAfee.com\Agent\mcupdate.exe

São criados os seguintes ficheiros:

– %SYSDIR%\msfsr.sys Outras investigações apontam para que este ficheiro, também, seja malware. Detectado como: TR/Drop.Agent.baw

– %SYSDIR%\drivers\%uma série de caracteres aleatórios%.sys Outras investigações apontam para que este ficheiro, também, seja malware. Detectado como: Worm/Piggi.A

Registry (Registo do Windows) As chaves seguintes são adicionadas (num loop infinito) ao registo, para executar os processos depois de reinicializar.

– [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
   • "SvcHost"="%SYSDIR%\svchost.exe:svchost.exe"
   • "reeipods"="%directório de execução do malware%"

Cria a seguinte entrada de forma a fazer um bypass à firewall do Windows XP:

– [HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\
   FirewallPolicy\StandardProfile\AuthorizedApplications\List]
   • "%directório de execução do malware%\%ficheiro
      executado%"="%directório de execução do
      malware%\%ficheiro
      executado%:*:enabled:@xpsp2res.dll,-22019"

E-mail Tem um motor SMTP integrado para enviar emails.É criada uma ligação directa com o servidor de destino. Tem as seguintes características:

De:
O endereço do remetente é falsificado.

Para:
– Endereços de email encontrados em determinados ficheiros no sistema.
– Endereços de e-mail recolhidos do WAB (Windows Address Book).

Assunto:
O seguinte:
   • Your hidden site, Your hidden website, You site, Your site, Your
      website, Poker, Poker technique, Poker strategy, Online poker, Gaming,
      Online gaming, Online casino, Casino, Myspace, Myspace details, Your
      myspace details, Look at this!, Screensaver attached, Movie attached,
      Video attached, Free game downloader attached, Play this, Free game
      attached, Game attached, Listen to this!, Listen to the attachment,
      Your speech attached, Your voice attached, Your mix attached, Your
      tune attached, Your YouTube movie attached, Your YouTube video
      attached, Your movie attached, Your video attached, Free - just open
      the attachment!, Free gift, Free offer, Free - See the attachment!,
      Free!, You attached!, Your photo attached, Your picture attached, Look
      at the attachment, Open this attachment, See the attachment, An
      important message, yousite, yoursite, yourwebsite, Tekken, Indiana
      Jones 4, Hilary Duff, Carmen Electra, Jessica Alba, Jennifer Lopez,
      Jessica Simpson, Angelina Jolie, Britney Spears, Paris Hilton, Pamela
      Anderson, Dragonball, Terminator 4, Alien vs. Predator 2, Resident
      Evil 3, Rush Hour 3, Live Free or Die Hard, Spider-Man 3, Premonition,
      The Hills Have Eyes II, Ghost Rider, Heroes season 2, Smith season 2,
      Shark season 2, Jericho season 2, Studio 60 on the Sunset Strip season
      2, Six Degrees season 2, CSI: London, Grey's Anatomy - next season,
      Lost season 4, details, msg, message, document, attachment, letter,
      text, mail transcript, instructions, readme, poker, pokertechnique,
      pokerstrategy, onlinepoker, gaming, onlinegaming, onlinecasino,
      casino, myspace, myspacedetails, yourmyspacedetails, your tax returns,
      your financial information, your financial details, your bank account
      details, your SSN, etc, your personal information, your personal
      details, Dungeons & Dragons, Online: Stormreach Pursuit Force, Auto
      Assault, Metal Gear: Subsistence, Extreme Ghouls n' Ghosts, Full Auto,
      Starcraft: Ghost Huxley, Splinter Cell: Double Agent, Halo 3, Star
      Trek: Legacy, Rainbow Six: Vegas, Final Fantasy XIII, Resident Evil 5,
      Resistance: Fall of Man, Assassin’s Creed, Virtua Fighter 5, Full
      Auto 2: Battlelines, Killzone, PS3, Crysis Warhammer, Online, Age Of
      Reckoning, Command & Conquer 3: Tiberium Wars, Hellgate: London Prey,
      Unreal Tournament 2007, Ghost Recon: Advanced Warfighter, Spore,
      BioShock, Half-Life 2: Aftermath, Star Wars: Empire at War, Enemy
      Territory: Quake Wars, Neverwinter Nights 2

Corpo:
O corpo do email é um dos seguintes:

   • Hi

     You gotta play this.

     The attached file will install the full game.

   • Hi
     You have to see it to believe it!
     --------------------------------------------------------------------------------
     Attachment: No Virus found.
     Scanned by Norton AntiVirus - symantec.com

   • Hi,
     We discovered this clip of you on a web site. You should hear it immediately.

   • Hi
     We discovered this movie of you on YouTube. You have to open it straight away.

   • Hi %email de utilizador%,
     You gotta play Resistance: Fall of Man (unreleased).
     The attached file will download the full game.
     This is completely free.

   • Hi %email de utilizador%,
     I found your personal details on the net.
     It looks like somebody has hijacked your computer and posted the attached file.
     You need to check the details in the attachment to see if they are genuine.

   • Hi
     I found this picture (attached) of you on the net. I think you should open it right now.

   • Hello %email de utilizador%,
     We saw this image (attached) of you on Flickr. You should open it immediately.

   • Hi %email de utilizador%,
     Somebody has broken into your MySpace account.
     You should verify the details in the attachment to see if they are real.

   • Hi
     I saw this image (attached) of you on somebody's blog. I think you should open it immediately.

   • Hi %email de utilizador%,
     I found a never seen before clip of Six Degrees season 2 (attached).
     You have to see it to believe it.

   • I heard this tape of you on somebody's blog. You have to listen to it right now.

   • Hi
     We saw this amazing free offer on the net.
     A brand new Creative Zen V Plus for free.
     Just open the attachment for details.

   • Hi %email de utilizador%,
     You might like to play Star Trek: Legacy (unreleased).
     The attached file will download the rest of the game.
     This is completely free.

   • Our records indicate that you have not updated your McAfee products recently.
     The attached file contains a cumulative rollup of security fixes necessary to help keep your computer safe.
     Please install it immediately by opening the attachment.
     McAfee Customer Support Team.
     McAfee.com

   • Hi
     Unbeatable Poker strategy.
     Just open the attachment for details.
     ________________________________

     ++ Attachment: No Virus found.
     ++ McAfee AntiVirus - mcafee.com
     ________________________________

   • Our records indicate that you have not updated your Microsoft products recently.
     The attached file contains a cumulative rollup of security fixes necessary to help keep your computer safe.
     Please install it immediately by opening the attachment.
     Microsoft Customer Support Team.
     Microsoft.com
     --------------------------------------------------------------------------------
     Attachment: No Virus found.

Atalho:
Os nomes dos ficheiros de atalhos são construídos a partir dos seguintes:

   • yourhiddensite
   • hiddensite
   • yousite
   • yoursite
   • yourwebsite
   • Tekken
   • Indiana Jones 4
   • Hilary Duff
   • Carmen Electra
   • Jessica Alba
   • Jennifer Lopez
   • Jessica Simpson
   • Angelina Jolie
   • Britney Spears
   • Paris Hilton
   • Pamela Anderson
   • Dragonball
   • Terminator 4
   • Alien vs. Predator 2
   • Resident Evil 3
   • Rush Hour 3
   • Live Free or Die Hard
   • Spider-Man 3
   • Premonition
   • The Hills Have Eyes II
   • Ghost Rider
   • Heroes season 2
   • Smith season 2
   • Shark season 2
   • Jericho season 2
   • Studio 60 on the Sunset Strip season 2
   • Six Degrees season 2
   • CSI: London
   • Grey's Anatomy - next season
   • Lost season 4
   • details
   • message
   • document
   • attachment
   • letter
   • transcript
   • instructions
   • readme
   • poker
   • pokertechnique
   • pokerstrategy
   • onlinepoker
   • gaming
   • onlinegaming
   • onlinecasino
   • casino
   • myspace
   • myspacedetails
   • yourmyspacedetails
   • your tax returns
   • your financial information
   • your financial details
   • your bank account details
   • your SSN etc
   • your personal information
   • your personal details
   • Dungeons & Dragons Online: Stormreach
   • Pursuit Force
   • Auto Assault
   • Metal Gear: Subsistence
   • Extreme Ghouls n' Ghosts
   • Full Auto
   • Starcraft: Ghost
   • Huxley
   • Splinter Cell: Double Agent
   • Halo 3
   • Star Trek: Legacy
   • Rainbow Six: Vegas
   • Final Fantasy XIII
   • Resident Evil 5
   • Resistance: Fall of Man
   • Assassin
   • s Creed
   • Virtua Fighter 5
   • Full Auto 2: Battlelines
   • Killzone PS3
   • Crysis
   • Warhammer Online Age Of Reckoning
   • Command & Conquer 3: Tiberium Wars
   • Hellgate: London
   • Unreal Tournament 2007
   • Ghost Recon: Advanced Warfighter
   • Spore
   • BioShock
   • Half-Life 2: Aftermath
   • Star Wars: Empire at War
   • Enemy Territory: Quake Wars
   • Neverwinter Nights 2
   • youtube-you

    Por vezes continuado pelas seguintes extensões falsas juntamente com espaços:
   • .wav
   • .wma
   • .mp3
   • .rtf
   • .html
   • .txt
   • .gif
   • .jpeg

    A extensão do ficheiro é uma das seguintes:
   • scr
   • pif
   • exe
   • bat
   • cmd
   • com

Exemplos de como o nome do ficheiro de atalho pode parecer:
   • Rainbow Six_Vegas.exe
   • you.scr
   • Mc Afee update.exe
   • yousite.com
   • myspace.txt.pif

O ficheiro de atalho é uma cópia do malware.

O email pode ser parecido com um dos seguintes:

Mailing Pesquisa endereços:
Procura endereços de email no seguinte ficheiro:
   • vbc, snm, smd, pst, pop, pmx, ply, nsf, na2, mmf, mlm, ldb, imc, imb,
      iaf, gup, gdb, gam, dvc, dld, clb, cdm, cat, pab, edb, btx, btr, brk,
      md, mb, bk, blt, adr, bib, bgt, bcn, bcm, bag, vcf, map, log, jav,
      nws, mht, wsh, vbs, uin, rtf, oft, js, eml, doc, dht, cgi, pdf, xsl,
      xml, sql, csv, tex, css, pl, adb, tbb, db, asp, php, sht, ht, txt

Infecção da rede Exploit:
Faz uso dos seguintes Exploits:
– MS04-007 (ASN.1 Vulnerability)
–MS06-040 (Vulnerability in Server Service)

Criação de endereços IP:
Cria endereços IP aleatórios e tenta estabelecer uma ligação com eles.

Terminar o processo Lista de serviços desactivados:
   • sharedaccess
   • wscsvc
   • lanmanserver
   • Browser
   • SymAppCore
   • navapsvc
   • McShield

Informações diversas Ligação à internet:
Para conferir a sua ligação à internet é contactado o seguinte servidor de DNS:
• A.ROOT-SERVERS.NET

Procura uma ligação de internet contactando o seguinte web site:
• www.mi5.gov.uk

Tecnologia de Rootkit Oculta o seguinte:
– Os seus próprios ficheiros
– Os seus próprios processos

Forma utilizada
• Esconde-se na API do Windows

Detalhes do ficheiro Empacotador de Runtime:
De forma a agravar a detecção e reduzir o tamanho do ficheiro é lançado com um empacotador de runtime.

Veja aqui uma breve descrição.

Descrição adicionada por Ernest Szocs em Tue, 06 Mar 2007 13:59 (GMT+1)
Descrição adicionada por Ernest Szocs em Wed, 07 Mar 2007 13:00 (GMT+1)

» About Malware
» About Phishing
» Viruses In the Wild

« back