Worm/Klez.E - Worm

In alte limbi

Scurta descriere

Descriere completa

Statistici

Nume:	Worm/Klez.E
Descoperit pe data de:	19/04/2002
Tip:	Vierme
ITW:	Da
Numar infectii raportate:	Mediu
Potential de raspandire:	Mediu spre ridicat
Potential de distrugere:	Mediu
Fisier static:	Nu
Marime:	~80.000 Bytes

General Metode de raspandire:
   • Email
   • Reteaua locala

Alias:
   • Symantec: W32/Klez.H@MM
   • Mcafee: W32/Klez.h@MM
   • Kaspersky: Email-Worm.Win32.Klez.h
   • TrendMicro: WORM_KLEZ.H
   • F-Secure: Win32.Klez.H@mm
   • Sophos: W32/Klez-H
   • Panda: W32/Klez.I
   • Grisoft: I-Worm/Klez.H
   • Eset: Win32/Klez.J
   • Bitdefender: Win32.Klez.H@mm

Sistem de operare:
   • Windows 95
   • Windows 98
   • Windows 98 SE
   • Windows NT
   • Windows ME
   • Windows 2000
   • Windows XP
   • Windows 2003

Efecte secundare:
   • Inchide aplicatiile de securitate
   • Creeaza un fisier malware
   • Utilizeaza propriul motor de email
   • Reduce setarile de securitate
   • Profita de vulnerabilitatile softului
   • Sustrage informatii

Fisiere Se copiaza in urmatoarele locatii:
   • %SYSDIR%\wink%sir de 3 caractere aleatoare%.exe
   • %TEMPDIR%\%combinatie de caractere aleatoare%%numar hexazecimal%.exe

Sterge urmatoarele fisiere:
   • ANTI-VIR.DAT
   • CHKLIST.DAT
   • CHKLIST.MS
   • CHKLIST.CPS
   • CHKLIST.TAV
   • IVB.NTZ
   • SMARTCHK.MS
   • SMARTCHK.CPS
   • AVGQT.DAT
   • AGUARD.DAT
   • Shlwapi.dll
   • Kernel32.dll
   • netapi32.dll
   • sfc.dll

Sterge fisierele care contin unul dintre urmatoarele texte:
   • _AVP32
   • _AVPCC
   • NOD32
   • NPSSVC
   • NRESQ32
   • NSCHED32
   • NSCHEDNT
   • NSPLUGIN
   • NAV
   • NAVAPSVC
   • NAVAPW32
   • NAVLU32
   • NAVRUNR
   • NAVW32
   • _AVPM
   • ALERTSVC
   • AMON
   • AVP32
   • AVPCC
   • AVPM
   • N32SCANW
   • NAVWNT
   • ANTIVIR
   • AVPUPD
   • AVGCTRL
   • AVWIN95
   • SCAN32
   • VSHWIN32
   • F-STOPW
   • F-PROT95
   • ACKWIN32
   • VETTRAY
   • VET95
   • SWEEP95
   • PCCWIN98
   • IOMON98
   • AVPTC
   • AVE32
   • AVCONSOL
   • FP-WIN
   • DVP95
   • F-AGNT95
   • CLAW95
   • NVC95
   • SCAN
   • VIRUS
   • LOCKDOWN2000
   • Norton
   • Mcafee
   • Antivir
   • TASKMGR
   • Sircam
   • Nimda
   • CodeRed
   • WQKMM3878
   • GRIEF3878
   • Fun Loving Criminal
   • Norton
   • Mcafee
   • Antivir
   • Avconsol
   • F-STOPW
   • F-Secure
   • Sophos
   • virus
   • AVP Monitor
   • AVP Updates
   • InoculateIT
   • PC-cillin
   • Symantec
   • Trend Micro
   • F-PROT
   • NOD32

Sunt create fisierele:

– Un fisier temporar care poate fi sters dupa aceea:
   • %TEMPDIR%\%combinatie de caractere aleatoare%%numar hexazecimal%.exe

– %PROGRAM FILES%\%sir de 3 caractere aleatoare%%numar hexazecimal%.exe Fisierul este executat dupa ce a fost creat. Analiza ulterioara a relevat ca si acest fisier este malware. Detectat ca: W32/Elkern.C

Registrii sistemului Urmatoarea cheie este adaugata in registri pentru a rula procesul la repornirea sistemului:

– [HKLM\Software\Microsoft\Windows\CurrentVersion\Run]
   • wink%sir de 3 caractere aleatoare% = %SYSDIR%\wink%sir de 3 caractere aleatoare%.exe

Urmatoarele chei sunt adaugate in registri pentru a incarca serviciul la repornirea sistemului:

– [HKLM\SYSTEM\CurrentControlSet\Services\
   Wink%sir de 3 caractere aleatoare%]
   • Type = 110
   • Start = 2
   • ErrorControl = 0
   • ImagePath = %SYSDIR%\wink%sir de 3 caractere aleatoare%.exe
   • DisplayName = Wink%sir de 3 caractere aleatoare%
   • "ObjectName"="LocalSystem"

– [HKLM\SYSTEM\CurrentControlSet\Services\Winkegh\Security]
   • Security = %hex values

– [HKLM\SYSTEM\CurrentControlSet\Services\Winkegh\Enum]
   • 0 = Root\LEGACY_WINK%sir de 3 caractere aleatoare%\0000
   • Count = 1
   • NextInstance = 1

Email Are un motor SMTP integrat. Va fi facuta o conexiune directa cu serverul destinatar. Iata caracteristicile lui:

Exploit:
It makes use of the following vulnerability: (Smt) (ro)
– MS01-020 (Incorrect MIME Header Can Cause IE to Execute E-mail Attachment)

De la:
Adresa este falsificata.

Catre:
– Adrese de email gasite pe sistem.
–Catre: Adrese de email obtinute din MSN Messenger
–Adrese de email obtinute de la ICQ Messenger

Formatul email-urilor:

Subiect: Worm Klez.E immunity
Corp mesaj:
   • Klez.E is the most common world-wide spreading worm.It's very dangerous by corrupting your files.
     Because of its very smart stealth and anti-anti-virus technic,most common AV software can't detect or clean it.
     We developed this free immunity tool to defeat the malicious virus.
     You only need to run this tool once,and then Klez will never come into your PC.
     NOTE: Because this tool acts as a fake Klez to fool the real worm,some AV monitor maybe cry when you run it.
     If so,Ignore the warning,and select 'continue'.
     If you have any question,please mail to me.

Subiect: W32.Elkern removal tools
Corp mesaj:
   • %simbol 1% give you the W32.Elkern removal tools
     W32.Elkern is a dangerous virus that can infect on Win98/Me/2000/XP.

     For more information,please visit http://www.%simbol 1%.com

Subiect: W32.Klez.E removal tools
Corp mesaj:
   • %simbol 1% give you the W32.Klez.E removal tools
     W32.Klez.E is a dangerous virus that spread through email.

     For more information,please visit http://www.%simbol 1%.com

De la: postmaster@%domeniul destinatarului%
Subiect: Undeliverable mail--%cuvinte aleatoare%
Corp mesaj:
   • The following mail can't be sent to:
      %adresa destinatarului%

     From: %adresa expeditorului%
     To: %adresa destinatarului%
     Subject: --%cuvinte aleatoare%
     The file is the original mail

De la: postmaster@%domeniul destinatarului%
Subiect: Returned mail--%cuvinte aleatoare%
Corp mesaj:
   • The following mail can't be sent to:
      %adresa destinatarului%

     From: %adresa expeditorului%
     To: %adresa destinatarului%
     Subject: --%cuvinte aleatoare%
     The file is the original mail

Subiect: A (very/special) %simbol 2% game
Corp mesaj:
   • (Hello,/Hi,) This is a (very/special) %simbol 2% game
     This game is my first work.
     You're the first player.
     I %simbol 3% you would %simbol 4% it.

Subiect: A (very/special) %simbol 2% website
Corp mesaj:
   • (Hello,/Hi,) This is a (very/special)%simbol 2% website
     I %simbol 3% you would %simbol 4% it.

Subiect: A (very) good/powerful tool
Corp mesaj:
   • (Hello,/Hi,) This is a (very) good/powerful website
     I %simbol 3% you would %simbol 4% it.
Subiect: A IE 6.0/WinXP patch
Corp mesaj:
   • (Hello,/Hi,) This is a IE 6.0/WinXP patch.
     I %simbol 3% you would %simbol 4% it.

Subiect:
Uneori subiectul poate lipsi.
Subiectul mesajului se compune din:

    Uneori incepe cu:
   • Fw:
   • Re:

    Urmata uneori de una din urmatoarele:
   • Hi,%nume utilizator al adresei destinatarului%,
   • Hello,%nume utilizator al adresei destinatarului%,

    Urmata uneori de una din urmatoarele:
   • Have a
   • Happy

   • how are you
   • let's be friends
   • darling
   • so cool a flash,enjoy it
   • your password
   • honey
   • some questions
   • please try again
   • welcome to my hometown
   • the Garden of Eden
   • introduction on ADSL
   • meeting notice
   • questionnaire
   • congratulations
   • sos!
   • Christmas
   • New year
   • Saint Valentine's Day
   • Allhallowmas
   • April Fools' Day
   • Lady Day
   • Assumption
   • Candlemas
   • All Souls'Day
   • Epiphany

   • japanese girl VS playboy
   • look,my beautiful girl friend
   • eager to see you
   • spice girls' vocal concert
   • japanese lass' sexy pictures

Corpul email-ului:
– Uneori corpul email-ului este gol.

%simbol 1% este inlocuit cu unul din urmatoarele:
   • Symantec
   • Mcafee
   • F-Secure
   • Sophos
   • Trendmicro
   • Kaspersky

%simbol 2% este inlocuit prin unul din urmatoarele:
   • new
   • funny
   • nice
   • humour
   • excite

%simbol 3% este inlocuit prin unul din urmatoarele:
   • wish
   • hope
   • expect

%simbol 4% este inlocuit prin unul din urmatoarele:
   • like
   • enjoy

Atasament:
Numele fisierelor atasate este alcatuit dupa cum urmeaza:

– Incepe cu unul din urmatoarele:
   • %fisier sau director existent%

    Extensia fisierului este una din urmatoarele:
   • .exe
   • .scr
   • .pif
   • .bat

– Incepe cu unul din urmatoarele:
   • %fisier sau director existent%

    Extensia fisierului este una din urmatoarele:
   • .txt
   • .htm
   • .html
   • .wab
   • .asp
   • .doc
   • .rtf
   • .xls
   • .jpg
   • .cpp
   • .pas
   • .mpg
   • .mpeg
   • .bak
   • .mp3
   • .pdf

Email-ul poate arata ca unul din urmatoarele:

Email Cautare adrese:
Cauta adrese de email in urmatoarele fisiere:
• .txt; .htm; .html; .wab; .asp; .doc; .rtf; .xls; .jpg; .cpp; .pas;
.mpg; .mpeg; .bak; .mp3; .pdf

Reţea Pentru a-si asigura raspandirea, programul malware incearca sa contacteze alte sisteme, asa cum este descris in continuare:

Creeaza o copie malware in urmatorul share de retea:
• %toate directoarele share%

Procesul de infectare:
Fisierul descarcat este salvat pe masina infectata, cu numele: %fisier sau director existent%

.txt
.htm
.html
.wab
.asp
.doc
.rtf
.xls
.jpg
.cpp
.pas
.mpg
.mpeg
.bak
.mp3
.pdf

.exe
.scr
.pif
.bat
.rar

Terminarea proceselor Procesele care contin urmatoarele siruri de caractere sunt oprite:
   • _AVP32; _AVPCC; NOD32; NPSSVC; NRESQ32; NSCHED32; NSCHEDNT; NSPLUGIN;
      NAV; NAVAPSVC; NAVAPW32; NAVLU32; NAVRUNR; NAVW32; _AVPM; ALERTSVC;
      AMON; AVP32; AVPCC; AVPM; N32SCANW; NAVWNT; ANTIVIR; AVPUPD; AVGCTRL;
      AVWIN95; SCAN32; VSHWIN32; F-STOPW; F-PROT95; ACKWIN32; VETTRAY;
      VET95; SWEEP95; PCCWIN98; IOMON98; AVPTC; AVE32; AVCONSOL; FP-WIN;
      DVP95; F-AGNT95; CLAW95; NVC95; SCAN; VIRUS; LOCKDOWN2000; Norton;
      Mcafee; Antivir; TASKMGR; Sircam; Nimda; CodeRed; WQKMM3878;
      GRIEF3878; Fun Loving Criminal; Norton; Mcafee; Antivir; Avconsol;
      F-STOPW; F-Secure; Sophos; virus; AVP Monitor; AVP Updates;
      InoculateIT; PC-cillin; Symantec; Trend Micro; F-PROT; NOD32

Alte informatii Sir de caractere:
In plus, mai contine urmatorul sir de caractere:
• Win32 Klez V2.01 & Win32 Foroux V1.0
Copyright 2002,made in Asia
About Klez V2.01:
1,Main mission is to release the new baby PE virus,Win32 Foroux
2,No significant change.No bug fixed.No any payload.

About Win32 Foroux (plz keep the name,thanx)
1,Full compatible Win32 PE virus on Win9X/2K/NT/XP
2,With very interesting feature.Check it!
3,No any payload.No any optimization
4,Not bug free,because of a hurry work.No more than three weeks from having such idea to accomplishing coding and testing

Pentru o descriere scurta click aici.

Descriere introdusa de Andrei Gherman la Tue, 09 Oct 2007 08:29 (GMT+1)
Descriere actualizata de Andrei Gherman la Tue, 09 Oct 2007 11:45 (GMT+1)

» About Malware
» About Phishing
» Viruses In the Wild

« back