Virus

W32/Yaha.L@mm

Analysis

  • Virus is 32bit, with a UPX compressed size of 34,304 bytes
  • Virus icon resembles that of a blue heart
  • Virus may search the following list and attempt to terminate any name-matching process running in memory -

    _AVP32
    _AVPCC
    _AVPM
    ACKWIN32
    ALERTSVC
    AMON.EXE
    ANTIVIR
    ATRACK
    AVCONSOL
    AVP.EXE
    AVP32
    AVPCC.EXE
    AVPM.EXE
    AVSYNMGR
    CFINET
    CFINET32
    ESAFE.EXE
    F-AGNT95
    F-PROT95
    FP-WIN
    FRW.EXE
    F-STOPW
    IAMAPP
    IAMSERV.EXE
    ICMON
    IOMON98
    LOCKDOWN2000
    LOCKDOWNADVANCED
    LUALL
    LUCOMSERVER
    MCAFEE
    N32SCANW
    NAVAPSVC
    NAVAPW32
    NAVLU32
    NAVRUNR
    NAVW32
    NAVWNT
    NISSERV
    NISUM
    NMAIN
    NOD32
    NORTON
    NPSSVC
    NRESQ32
    NSCHED32
    NSCHED32
    NSCHEDNT
    NSPLUGIN
    NVC95
    PCCIOMON
    PCCMAIN
    PCCWIN98
    PCCWIN98
    PCFWALLICON
    POP3TRAP
    PVIEW
    PVIEW95
    REGEDIT
    RESCUE32
    RMVTRJANSAFEWEB
    SCAN32
    SWEEP95
    SYMPROXYSVC
    TDS2-98
    TDS2-NT
    VET95
    VETTRAY
    VSECOMR
    VSHWIN32
    VSSTAT
    WEBSCANX
    WEBTRAP
    ZONEALARM

  • Virus may copy itself to the Windows\System folder as "WinServices.exe", and modify the registry to run this any time an EXE file is run -
  • HKEY_CLASSES_ROOT\exefile\shell\open\command
    (Default) = ""C:\Windows\System\WinServices.exe" undefined1 undefined*"

  • Virus modifies the registry to run at Windows startup -

    HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\
    CurrentVersion\Run\
    winservices = C:\Windows\System\winservices.exe

  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\
    CurrentVersion\RunServices\
    winservices = C:\Windows\System\winservices.exe

  • Next, the virus will scavenge the local drive for email addresses and send a copy of itself to addresses found in varying email formats, based on a randomly selected subject line and body text
  • Message is structured such that it uses an exploit which will cause the attachment to launch automatically when the message is either opened, or previewed in Outlook
  • One property of the MIME encoded email is the following -

    boundary=#r0xx#

  • The attachment will be one of the following file names -

    Beautifull.scr
    Body_Building.scr
    Britney_Sample.scr
    Codeproject.scr
    Cupid.scr
    FixElkern.com
    FixKlez.com
    FreakOut.exe
    Free_Love_Screensavers.scr
    Hacker.scr
    Hacker_The_LoveStory.scr
    Hardcore4Free.scr
    I_Love_You.scr
    Jenna_Jemson.scr
    King_of_Figthers.exe
    KOF.exe
    KOF_Demo.exe
    KOF_Fighting.exe
    KOF_Sample.exe
    KOF_The_Game.exe
    KOF2002.exe
    Love.scr
    My_Sexy_Pic.scr
    MyPic.scr
    MyProfile.scr
    Notes.exe
    Peace.scr
    Playboy.scr
    Plus2.scr
    Plus6.scr
    Project.exe
    Ravs.scr
    Real.scr
    Romantic.scr
    Romeo_Juliet.scr
    Screensavers.scr
    Services.scr
    Sex.scrSoccer.scr
    Sexy_Jenna.scr
    SQL_4_Free.scr
    Stone.scr
    Sweetheart.scr
    The_Best.scr
    THEROCK.scr
    up_life.scr
    Valentines_Day.scr
    VXer_The_LoveStory.scr
    Ways_To_Earn_Money.exe
    World_Tour.scr
    xxx4Free.scr
    zDenka.scr
    zXXX_BROWSER.exe

  • This virus may set the Internet Explorer start page to one of the following hyperlinks-
  • http://www.unixhideout.com
    http://www.hirosh.tk
    http://www.neworder.box.sk
    http://www.blacksun.box.sk
    http://www.coderz.net
    http://www.hackers.com/html/neohaven.html
    http://www.ankitfadia.com
    http://www.hrvg.tk
    http://www.hackersclub.up.to
    http://geocities.com/snak33y3s

  • Virus contains the following comments within the code -

'======================================================'
'W32.@YerH$.B (all r1ght$ re$erv3d.. ;) )'
'w3 aRe tHe gRe@t 1nD1aN$..'
'------------------------------------------------------'
'm@iN mIssIoN iS t0 sPreAd tHe nAmE @YerH$'
's00 mUch t0 c0me..'
'iNclUdEd DDoS c0mp0neNtS c@usE oF sHiT p@kI l@meRs'
'eXp3ct th3 uNeXp3ctEd'
'dEdic@t3d t0 : mY b3$t fRi3nD'
'======================================================'