Email-Worm.Win32.Zhelatin.v
From Total Malware Info
Email worm, which spreads its body in attachments to email-messages. It sends itself to all found on victims machines email addresses.
Worm is a Windows portable executable file.The size of its components vary from 5 to 50 kilobytes. Its body is packed with UPX executable packer.
Contents |
Installation
When launched, worm main executable copies itself to Windows directory with the following name:
%System%\alsys.exe
After that worm creates a file with random name and “.exe” extension in its work directory and launches it.
Then worm creates the following registry entries:
[HKLM\Software\Microsoft\Windows\CurrentVersion\Run] "Agent" = "%System%\alsys.exe" [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] "Agent" = "%System%\alsys.exe"
So the worm executable would now be launched every time the windows starts.
Worm disables the following system service "Windows Firewall/Internet Connection Sharing (ICS)" by changing the following registry key value:
[HKLM\System\CurrentControlSet\Services\SharedAccess] "Start" = "4"
In such a way enabling all network activity for own executable and leaving the user’s system vulnerable.
Propagation via email
Worm starts searching for emails to spread itself in files on all hard drive partitions beginning from the last one.
While sending infected emails worm creates a direct connection to SMTP servers. Worm does not send infected emails to addresses, that contain folowing strings:
microsoft .gov .mil
Email Subject is being randomly chosen from the list below:
Magic of Flowers Sending You My Love Together You and I Window of Beauty Doing It for You Evening Romance Wrapped Up Most Beautiful Girl Touched by Love If I Knew Heart of Mine Til the End of Time With This Ring Tender Whispers Soul Partners With All of My Heart I Always Knew Awaiting Your Love Want to Meet? So in Love This Feeling Red Rose Until the Day My Invitation Worthy of You You're the One So in Love You and I Forever Words I Write The Candle's Light True Love My Perfect Love Waiting for You This Day Forward Without Your Love Now and Forever Thanks...Love Just You A Sweet Love Search for One A Song to You If I Could Hand in Hand I Win with You Wine and Roses Back Together I Give to You That Special Love Our Love Old Together Cyber Love Against All Odds Hey Cutie Our Wedding Day My Eye on You Unique Love Full Heart Forever in Love To New Spouse For Better of For Worse All For You When I'm With You Everyone Needs Someone Heart is Breaking With All My Love Cuddle Up Safe and Sound Made for Each Other Brand New Love Someone at Last You and I Hold On All That Matters Our Two Hearts You Asked Me Why Wish Upon a Star For You Brand New Love You're so Far Away Together Again I wish The Long Haul Love You Deeply In Love It's Your Move Love Birds Safe With You Sending Kiss You + Me I Would Do Anything Vacation Love The Kiss Hand in Hand Now I Know Live With Me Pockets of Love He Blessed Our Lives Two of a Kind Soul Mates I Still Love You Dancing With You Forever and Ever Twice Blest Longing for You Thinking of You Twilight Paradise Wish I Could Tell You Teddy Bear & Roses Let's Get Frisky Cuddle Me Please Solitary Beauty Take My Hand So Unique P.M.S We Have Walked Fields Of Love I Am Lost In You Bewitching Moonlight The Letter Till Morning's Light Trunk Full Of Love Your Silly Smile Till Morninig's Light Just You & Me A Special Flower for You The Sweet Taste of Love A Red Hot Kiss Won't you dance with me A Special Kiss Our love is torn by miles Every Inch of Your Body My Heart belongs to you Steamy Dream Moonlit Waterfall My Heart is Thinking A Weekend Getaway Summer Love A Hug & Roses How Much I Love You Love for Granted Thinking about you Angel of Love You're Soo kissable From this day forward In My Heart Between Us Hold Me (distant love) I Would Give you Anything A Bouquet of Love I Think of You Wild Nights--Wild Nights Memories You are out of this world When I look at you Last Night was Hot! Peek-A-Boo You Lucky Duck! 5 Reasons I Love You I Can't Function Our Love Everyday Emptiness Inside Me Love is in the Air We're a Perfect Fit A Romantic Place I Love You Mower The Mood for Love Love at First Sight You Brighten My Day You're My Hero Can't Wait to See You! Showers Of Love You Were Worth the Wait Crazy way to say I Luv U Times Are Hard, I Luv U You Rock Me! Puppy Love You Are My Guiding Star We Are Different I Woof You A Monkey Rose for You A Kiss for You A Little (sex) Card The Love Bugs Kisses, Hugs & Roses Feeling Horny? A Day in Bed Coupon Dream Date Coupon Bubble Bath Coupon Steamy Sex Coupon A Relaxing Coupon Massage Coupon Dinner Coupon Romantic Picnic Coupon Breakfast in Bed Coupon Kiss Coupon Passionate Kiss Only You Internet Love Want You to Know Will You? I'll Be Your Man I Love Thee I Love You So Rose for my Love Baby, I'll Be There Unmatchable Beauty I Believe Dream Girl I Dream of you I am Complete Love Remains When I'm With You Our Love is Strong The Miracle of Love Inside My Heart Our Love Will Last For You....My Love The Mood for Love A Token of My Love Miracle of Love A Kiss So Gentle Why I Love You Falling In Love with You The Dance of Love Sending You My Love Hugging My Pillow Our Love Nest Wrapped in Your Arms I Love You Soo Much Eternity of Your Love Our Love is Free My Love Your Love Has Opened When You Fall in Love The Time for Love I Love Thee I Love You with All I Am Miracle of Love
Field “From:” is filled by randomly chosen string from the following list:
Anita April Ara Aretina Amorita Alysia Aldora Barbra Becky Bella Briana Bridget Blenda Bettina Caitlin Chelsea Clarissa Carmen Carla Cara Camille Damita Daria Danielle Diana Doris Dora Donna Ebony Eden Eliza Erika Eve Evelyn Emily Faith Gale Gilda Gloria Haley Holly Helga Ivory Ivana Iris Isabel Idona Ida Julie Juliet Joanna Jewel Janet Katrina Kacey Kali Kyle Kassia Kara Lara Laura Lynn Lolita Lisa Linda Myra Mimi Melody Mary Maia Nadia Nova Nina Nora Natalie Naomi Nicole Olga Olivia Pamela Peggy Queen Rachel Rae Rita Ruby Rosa Silver Sharon Uma Ula Valda Vanessa Valora Violet Vivian Vicky Wendy Willa Xandra Xylia Xenia Zilya Zoe Zenia
Attachment file has one of the following names:
flash postcard.exe Flash Postcard.exe Greeting Card.exe greeting card.exe Greeting Postcard.exe greeting postcard.exe Postcard.exe postcard.exe
Payload
Worm searches the hard drive for files with the following extensions:
.wab .txt .msg .htm .shtm .stm .xml .dbx .mbx .mdx .eml .nch .mmf .ods .cfg .asp .php .pl .wsh .adb .tbb .sht .xls .oft .uin .cgi .mht .dhtm .jsp .dat .lst
When such file is found, worm reads its contents and searches it for email-addresses. All gathered from victims machine email addresses are sent in HTTP request to the remote attacker to the following address ***.177.26.27.
Gathered email addresses can be further used to create databases and dispatch spam.
Worm ignores addresses, that contain the following strings:
@microsoft rating@ f-secur news update anyone@ bugs@ contract@ feste gold-certs@ help@ info@ nobody@ noone@ kasp admin icrosoft support ntivi unix bsd linux listserv certific sopho @foo @iana free-av @messagelab winzip google winrar samples abuse panda cafee spam pgp @avp. noreply local root@ postmaster@
Also worm tries to kill processes that contain the following strings in their names:
alsys anti viru troja avp nav rav reged nod32 spybot zonea vsmon avg blackice firewall msconfig lockdown f-pro hijack taskmgr mcafee
Removal instructions
If your computer was not protected by anti-virus software and was infected by this malware progam, to manually remove it please follow the instructions below:
- Using Task Manager terminate the trojan process.
- Delete the original trojan file (its file name and location depends on the way the trojan originally penetrated the target computer).
- Delete the following file:
%System%\alsys.exe
- Delete the following parameters in registry keys:
[HKLM\Software\Microsoft\Windows\CurrentVersion\Run] "Agent" = "%System%\alsys.exe" [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] "Agent" = "%System%\alsys.exe"
- Check your system for viruses using updated anti-virus definitions.
