Worm/Womble.D - Worm

In alte limbi

Scurta descriere

Descriere completa

Statistici

Nume:	Worm/Womble.D
Descoperit pe data de:	12/09/2006
Tip:	Vierme
ITW:	Da
Numar infectii raportate:	Scazut spre mediu
Potential de raspandire:	Mediu spre ridicat
Potential de distrugere:	Mediu
Fisier static:	Da
Marime:	83.456 Bytes
MD5:	a7eed18c21897e50bbe167b8f438b9af
Versiune VDF:	6.35.01.212
Versiune IVDF:	6.35.01.216

General Metode de raspandire:
   • Email
   • Reteaua locala

Alias:
   • Symantec: W32.Womble.A@mm
   • Mcafee: W32/Womble@MM
   • Kaspersky: Email-Worm.Win32.Womble.d
   • F-Secure: Email-Worm.Win32.Womble.d

Sistem de operare:
   • Windows 98
   • Windows 98 SE
   • Windows NT
   • Windows ME
   • Windows 2000
   • Windows XP
   • Windows 2003

Efecte secundare:
   • Descarca fisiere malware
   • Utilizeaza propriul motor de email
   • Modificari in registri

Fisiere Se copiaza in urmatoarea locatie:
   • %SYSDIR%\%cuvinte aleatoare%.exe

Creeaza urmatoarele directoare:
   • %home%\Local Settings\Application Data\Microsoft\WinTools\dvd_info
   • %home%\Local Settings\Application Data\Microsoft\WinTools\free
   • %home%\Local Settings\Application Data\Microsoft\WinTools\h_core
   • %home%\Local Settings\Application Data\Microsoft\WinTools\l_this
   • %home%\Local Settings\Application Data\Microsoft\WinTools\lunch
   • %home%\Local Settings\Application Data\Microsoft\WinTools\my_staff
   • %home%\Local Settings\Application Data\Microsoft\WinTools\new_mp3
   • %home%\Local Settings\Application Data\Microsoft\WinTools\new_video
   • %home%\Local Settings\Application Data\Microsoft\WinTools\photo
   • %home%\Local Settings\Application Data\Microsoft\WinTools\sh_docs
   • %home%\Local Settings\Application Data\Microsoft\WinTools\take_it
   • %home%\Local Settings\Application Data\Microsoft\WinTools\video
   • %home%\Local Settings\Application Data\Microsoft\WinTools\xxx

Scrie pe disc copii ale lui alegand numele fisierului din listele:
– Catre: %home%\Local Settings\Application Data\Microsoft\WinTools\dvd_info Folosind unul din urmatoarele nume:
   • bush
   • Me
   • My passwords
   • MyWife
   • Seduction secrets
   • MySexMovie
   • MySexPicture
   • WallPaper
   • anna
   • Windows serial number
   • GoogleHack
   • OurNewCar
   • OurNewHouse

   • .doc
   • .jpg
   • .txt

   • .exe
   • .pif

– Catre: %home%\Local Settings\Application Data\Microsoft\WinTools\free Folosind unul din urmatoarele nume:
   • bush
   • Me
   • My passwords
   • MyWife
   • Seduction secrets
   • MySexMovie
   • MySexPicture
   • WallPaper
   • anna
   • Windows serial number
   • GoogleHack
   • OurNewCar
   • OurNewHouse

   • .doc
   • .jpg
   • .txt

   • .exe
   • .pif

– Catre: %home%\Local Settings\Application Data\Microsoft\WinTools\h_core Folosind unul din urmatoarele nume:
   • bush
   • Me
   • My passwords
   • MyWife
   • Seduction secrets
   • MySexMovie
   • MySexPicture
   • WallPaper
   • anna
   • Windows serial number
   • GoogleHack
   • OurNewCar
   • OurNewHouse

   • .doc
   • .jpg
   • .txt

   • .exe
   • .pif

– Catre: %home%\Local Settings\Application Data\Microsoft\WinTools\l_this Folosind unul din urmatoarele nume:
   • bush
   • Me
   • My passwords
   • MyWife
   • Seduction secrets
   • MySexMovie
   • MySexPicture
   • WallPaper
   • anna
   • Windows serial number
   • GoogleHack
   • OurNewCar
   • OurNewHouse

   • .doc
   • .jpg
   • .txt

   • .exe
   • .pif

– Catre: %home%\Local Settings\Application Data\Microsoft\WinTools\lunch Folosind unul din urmatoarele nume:
   • bush
   • Me
   • My passwords
   • MyWife
   • Seduction secrets
   • MySexMovie
   • MySexPicture
   • WallPaper
   • anna
   • Windows serial number
   • GoogleHack
   • OurNewCar
   • OurNewHouse

   • .doc
   • .jpg
   • .txt

   • .exe
   • .pif

– Catre: %home%\Local Settings\Application Data\Microsoft\WinTools\my_staff Folosind unul din urmatoarele nume:
   • bush
   • Me
   • My passwords
   • MyWife
   • Seduction secrets
   • MySexMovie
   • MySexPicture
   • WallPaper
   • anna
   • Windows serial number
   • GoogleHack
   • OurNewCar
   • OurNewHouse

   • .doc
   • .jpg
   • .txt

   • .exe
   • .pif

– Catre: %home%\Local Settings\Application Data\Microsoft\WinTools\new_mp3 Folosind unul din urmatoarele nume:
   • bush
   • Me
   • My passwords
   • MyWife
   • Seduction secrets
   • MySexMovie
   • MySexPicture
   • WallPaper
   • anna
   • Windows serial number
   • GoogleHack
   • OurNewCar
   • OurNewHouse

   • .doc
   • .jpg
   • .txt

   • .exe
   • .pif

– Catre: %home%\Local Settings\Application Data\Microsoft\WinTools\new_video Folosind unul din urmatoarele nume:
   • bush
   • Me
   • My passwords
   • MyWife
   • Seduction secrets
   • MySexMovie
   • MySexPicture
   • WallPaper
   • anna
   • Windows serial number
   • GoogleHack
   • OurNewCar
   • OurNewHouse

   • .doc
   • .jpg
   • .txt

   • .exe
   • .pif

– Catre: %home%\Local Settings\Application Data\Microsoft\WinTools\photo Folosind unul din urmatoarele nume:
   • bush
   • Me
   • My passwords
   • MyWife
   • Seduction secrets
   • MySexMovie
   • MySexPicture
   • WallPaper
   • anna
   • Windows serial number
   • GoogleHack
   • OurNewCar
   • OurNewHouse

   • .doc
   • .jpg
   • .txt

   • .exe
   • .pif

– Catre: %home%\Local Settings\Application Data\Microsoft\WinTools\sh_docs Folosind unul din urmatoarele nume:
   • bush
   • Me
   • My passwords
   • MyWife
   • Seduction secrets
   • MySexMovie
   • MySexPicture
   • WallPaper
   • anna
   • Windows serial number
   • GoogleHack
   • OurNewCar
   • OurNewHouse

   • .doc
   • .jpg
   • .txt

   • .exe
   • .pif

– Catre: %home%\Local Settings\Application Data\Microsoft\WinTools\take_it Folosind unul din urmatoarele nume:
   • bush
   • Me
   • My passwords
   • MyWife
   • Seduction secrets
   • MySexMovie
   • MySexPicture
   • WallPaper
   • anna
   • Windows serial number
   • GoogleHack
   • OurNewCar
   • OurNewHouse

   • .doc
   • .jpg
   • .txt

   • .exe
   • .pif

– Catre: %home%\Local Settings\Application Data\Microsoft\WinTools\video Folosind unul din urmatoarele nume:
   • bush
   • Me
   • My passwords
   • MyWife
   • Seduction secrets
   • MySexMovie
   • MySexPicture
   • WallPaper
   • anna
   • Windows serial number
   • GoogleHack
   • OurNewCar
   • OurNewHouse

   • .doc
   • .jpg
   • .txt

   • .exe
   • .pif

– Catre: %home%\Local Settings\Application Data\Microsoft\WinTools\xxx Folosind unul din urmatoarele nume:
   • bush
   • Me
   • My passwords
   • MyWife
   • Seduction secrets
   • MySexMovie
   • MySexPicture
   • WallPaper
   • anna
   • Windows serial number
   • GoogleHack
   • OurNewCar
   • OurNewHouse

   • .doc
   • .jpg
   • .txt

   • .exe
   • .pif

– Catre: c:\system32\ Folosind unul din urmatoarele nume:
   • winupdate.exe
   • netupdate.exe
   • winlog.exe
   • winlogin.exe

– Catre: %directoare partajate din retea% Folosind unul din urmatoarele nume:
   • bush
   • Me
   • My passwords
   • MyWife
   • Seduction secrets
   • MySexMovie
   • MySexPicture
   • WallPaper
   • anna
   • Windows serial number
   • GoogleHack
   • OurNewCar
   • OurNewHouse

   • .doc
   • .jpg
   • .txt

   • .exe
   • .pif

Incearca sa descarce cateva fisiere:

– Adresa este urmatoarea:
   • support.365soft.info/current/**********
Acest fisier poate contine si alte locatii de descarcare si poate servi ca sursa de noi amenintari.

– Adresa este urmatoarea:
   • support.365soft.info/current/**********
Acest fisier poate contine si alte locatii de descarcare si poate servi ca sursa de noi amenintari.

– Adresa este urmatoarea:
   • support.365soft.info/current/**********
Acest fisier poate contine si alte locatii de descarcare si poate servi ca sursa de noi amenintari.

Registrii sistemului Urmatoarea cheie este adaugata in registri pentru a rula procesul la repornirea sistemului:

– [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
   • windows_startup=%SYSDIR%\%cuvinte aleatoare%.exe

Urmatoarele chei sunt adaugate in registrii sistemului:

– [HKLM\SOFTWARE\WinUpdate]
   • "Version"=dword:00000004

– [HKLM\SOFTWARE\WinUpload]
   • "bot1.exe"=dword:00000002
   • "bot2.exe"=dword:00000002
   • "l.exe"=dword:00000002
   • "t169.exe"=dword:00000002

– [HKCU\Software\Microsoft\WAB\WAB4]
   • "FirstRun"=dword:00000001

– [HKCU\Software\Microsoft\Windows\CurrentVersion]
   • "wmf.1.1"=dword:01c6db12
   • "wmf.1.2"=dword:e8fc9740

Urmatoarele chei din registri sunt modificate:

– [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
   Vechea valoare:
   • "Shell"="Explorer.exe"
   • "Userinit"="%SYSDIR%\userinit.exe"
   Noua valoare:
   • "Shell"="Explorer.exe%spatii libere% %SYSDIR%\%cuvinte aleatoare%.exe"
   • "Userinit"="%SYSDIR%\userinit.exe%spatii libere% ,%SYSDIR%\%cuvinte aleatoare%.exe"

Email Are un motor SMTP integrat. Va fi facuta o conexiune directa cu serverul destinatar. Iata caracteristicile lui:

De la:
De la: Adresa expeditorului este chiar contul Outlook al utilizatorului

Catre:
– Adrese de email gasite pe sistem.
– Adrese de email obtinute din WAB (Windows Address Book)

Subiect:
Unul din urmatoarele:
   • !!; Action Bush; FIFA; Helo; Hi; important; Incredible!!; info; Kiss;
      Laura; Laura and John; Lola; Look at this!!!; Miss Khan; Nataly; Ola;
      Olympus; Paula; pic; pics; private; private pics; Re:; Re: hi;
      Re:info; RE: pic; read this; Robert; Sex

Corpul email-ului:
Corpul email-ului este:

   • Hi !!!

     %combinatie de caractere aleatoare%

     %combinatie de caractere aleatoare%
     --

     Best Regards

Atasament:
Numele fisierelor atasate este alcatuit dupa cum urmeaza:

– Incepe cu unul din urmatoarele:
   • bush
   • Me
   • My passwords
   • MyWife
   • Seduction secrets
   • MySexMovie
   • MySexPicture
   • WallPaper
   • anna
   • Windows serial number
   • GoogleHack
   • OurNewCar
   • OurNewHouse

continuand cu una din urmatoarele:
   • .jpg
   • .doc
   • .txt

    Urmata uneori de una din urmatoarele:
   • .pif
   • .exe
   • .zip
   • .pif.zip
   • .exe.zip

Atasamentul este o copie malware.

Email-ul poate arata ca unul din urmatoarele:

Reţea Pentru a-si asigura raspandirea, programul malware incearca sa contacteze alte sisteme, asa cum este descris in continuare:

Exploit:
Foloseste urmatoarele vulnerabilitati:
– MS04-011 (LSASS Vulnerability)
– MS05-039 (Vulnerability in Plug and Play)

Backdoor Servere contactate:
Urmatoarele:
   • support.365soft.info/current/**********
   • support.365soft.info/current/**********
   • support.software602.com/current/**********
   • support.software602.com/current/**********
   • anyproxy.net/current/**********
   • anyproxy.net/current/**********
   • support.enviroweb.org/current/**********
   • support.enviroweb.org/current/**********
   • support.nikontech.com/current/**********
   • support.nikontech.com/current/**********
   • mymail.100hotmail.com/current/**********
   • mymail.100hotmail.com/current/**********
   • server1.mymail.ph/current/**********
   • server1.mymail.ph/current/**********
   • mymail.bokee.com/current/**********
   • mymail.bokee.com/current/**********
   • mail.96520.org/current/**********
   • mail.96520.org/current/**********
   • 211.184.55.7/current/**********
   • 211.184.55.7/current/**********
   • update.snowsoft.co.kr/current/**********
   • update.snowsoft.co.kr/current/**********
   • update.wwwmail.org/current/**********
   • update.wwwmail.org/current/**********
   • update.mediaroz.com/current/**********
   • update.mediaroz.com/current/**********
   • update.co.tv/current/**********
   • update.co.tv/current/**********
   • www.3btasarim.com/current/**********
   • www.3btasarim.com/current/**********
   • baishui.info/current/**********
   • baishui.info/current/**********
   • jiji.2tw.info/current/**********
   • jiji.2tw.info/current/**********

Astfel se pot transmite informatii. Aceasta se face printr-o interogare HTTP GET intr-un script PHP.

Trimte informatii despre:
    • Statusul actual al malware-ului

Furt de informatii Incearca sa obtina urmatoarele informatii:
– Informatii despre contul de email, obtinute din cheia de registru: HKCU\SoftwareMicrosoft\Internet Account Manager\Accounts

Alte informatii Conexiune internet:
Pentru a verifica legatura la internet se conecteaza la urmatoarele servere DNS:
   • *.GTLD-SERVERS.net
   • *.lan.tjhsst.edu

Cauta o conexiune Internet, contactand urmatorul website:
   • www.sun.com/index.html

Mutex:
Creeaza urmatorul mutex:
   • wmf.mtx.4

Detaliile fisierului Limbaj de programare:
Limbaj de programare folosit: C (compilat cu Microsoft Visual C++).

Compresia fisierului:
Pentru a ingreuna detectia si a reduce marimea fisierului, este folosit un program de compresie runtime.

Pentru o descriere scurta click aici.

Descriere introdusa de Adriana Popa la Fri, 15 Sep 2006 14:33 (GMT+1)
Descriere actualizata de Adriana Popa la Mon, 18 Sep 2006 16:11 (GMT+1)

» About Malware
» About Phishing
» Viruses In the Wild

« back