IM-Worm:W32/Pykse.A is an instant messaging worm that propagates through Skype. There is a weblog post on the matter.

Once IM-Worm:W32/Pykse.A has been executed, it will show a picture of a lightly dressed woman as below:


The image above has been blurred.

IM-Worm:W32/Pykse.A then drops the following files:

• %sysdir%Invisible002.dll - contains most of malicious code
• %sysdir%system32Skype.exe
  

It adds the following auto start registry entry to enable its automatic execution upon boot up:

• HKCUSoftwareMicrosoftWindowsCurrentVersionRun
  SkypeStartup = "%sysdir%Skype.exe"
  
• HKLMSOFTWAREMicrosoftWindowsCurrentVersionRun
  SkypeStartup = "%sysdir%Skype.exe"
  

It also adds the .DLL component as a BHO (Browser Helper Object) so that once the Internet browser is loaded, the malware is also loaded simultaneously.

IM-Worm:W32/Pykse.A creates the following key, to save some of its installation details:

• HKCUSoftwareSkypeWormcfg

It creates the following mutexes to signify each malicious routine. No duplicate mutex could be created to ensure that only these three mutexes are present in the memory at one particular time:

• Skype Worm spreader mutex - Spreading routine
• Skype Worm server mutex1 - Other routines
• aaa111226 - Iexplore.exe injection

IM-Worm:W32/Pykse.A spreads via Skype by sending a message with a malware link to all online friends in Skype' contact list using Skype API.

The message is randomly chosen from the following list:



It sets the Skype user's status to DND (Do not Disturb) so that the user cannot be actively notified for incoming calls or messages.

It visits the following none malicious links:

• http://aras.lookingat.us/index.htm
• http://asilas.my-php.net/index.html
• http://bobodada.3-hosting.net/index.html
• http://bobos45.bebto.com/index.html
• http://gogo442.hatesit.com/index.html
• http://jackdaniels.110mb.com/index.html
• http://timboss.1majorhost.com/index.html
• http://zozole.php0h.com/index.html

Moreover the following site is also visited, probably a counter for the number of infected machines:

• http://aras.allfreehost.net/c[REMOVED]nt.php

Last update 18 April 2007

 

TOP