Home / malware

PDF

Win32.Blondy.A@mm

First posted on 21 November 2011.
Source: BitDefender

Aliases :

Win32.Blondy.A@mm is also known as N/A.

Explanation :

This is an Internet worm written in Visual C++ that spreads via email, network shares/drives, Kazaa file sharing and IRC; it also acts as an IRC backdoor server.
When run for the first time, the virus will display a fake error message:

The virus will make copies of itself in the Windows folder, the Windows System folder and a random subfolder of the Program Files folder; the copies will be given random names, by including names of existing files (or the respective Program Files subfolder) and the following substrings:
run, dx, cmd, 16, 32, 98, lib, vxd, sys, dll, cfg, def The following registry entries will be created to run the virus at start-up:
- HKLMSoftwareMicrosoftCurrentVersionRunLoadSystemProfile = powprof.dll,LoadCurrentUserProfile
- HKLMSoftwareMicrosoftCurrentVersionRun

=

The registry entry HKCRexefileshellopencommand will be modified in order to launch the virus every time an executable file is launched by the user; after installing itself this way, the virus will not allow the execution of programs containing the following substrings in the name:
- panda
- avp
- kaspers
- f-prot
- f-secure
- antivir
- conseal
- worm + guard
- zone + labs
- mc + afee
- pc + cillin
- black + ice
- norton + virus
A line will be added in the [windows] section of the win.ini file, in order to run the Windows System copy of the worm at start-up.
The worm continuously checks if these "installation" procedures have been disabled, and reenables them if so.
Two "configuration files" will be created and maintained by the worm in the Windows folder; they both have random names generated in a similar way as the ones above. One of these files for example keeps a list of email addresses to which the worm has sent or is planning to send email messages.
The virus will search for windows and processes that include the following substrings in the name:
- black
- panda
- shield
- guard
- scan
- mcafee
- nai_vs_stat
- iomon
- navap
- avp
- alarm
- f-prot
- secure
- labs
- antivir
and attempts to close them; if a matching process has been found, after terminating its execution the virus will attempt to erase its file.
A thread of the virus will periodically scan the fixed and network-mapped drives. While scanning the fixed drives, the virus will modify the mIRC script files, collect email addresses (from wab files), and attempt to delete vbs (Visual Basic script) files in the Windows and Windows System folders. It will copy itself and create an "autorun.inf" file on mapped drives, in order for users to get infected when accessing that drive with Windows Explorer.
The worm also copies itself on network shared folders.
It tries to hide windows named "Outlook Express", "Choose Profile", "Internet Mail", but appears to fail in doing so.
Email messages are sent to addresses collected from wab (Windows Address Book) files and addresses gathered by using MAPI functions. The sender's address may be forged, the subject and body may vary, as well as the name of the attached file. The virus seems to attempt to use the infamous IFRAME exploit for some email messages it sends (see http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/MS01-020.asp for more informations and a fix for this vulnerability) in order for the email attachement to be automatically run when the message is previewed ( on systems using Outlook/Outlook Express and unpatched versions of Internet Explorer 5.xx).
In some messages, the address of the sender may be formed by joining the following components:
- dreamy / candy_f / bryan16 / jerry / baby_17 / neo / trish1 / linda17 / monica / nicole / angel_f / blue16 / tweety / alice / jane17 / badboy / rap_girl / CrazyGirl / steve / happy / amanda / crazy;
- @hotmail.com / @yahoo.com / @mail.com / @yahoo.co.uk / @usa.net.
The subject line may be built up by adding the following words:
- HeY, ZzZz, Bla Bla, HoWie, Happy, Hi again, Wow, Hi, Hello, Hey Ya, Boom, Hi There
or the Bulgarian versions:
- Zdrasti, Zdr Otnovo, Ohoo, Ei dupe, Pisamce, TinKi WinKy, ZzZz, Bla Bla, Hey, Privet, Boom
and various smiley sequences.
The worm also includes a list of fixed combinations of senders/subjects/message bodies/attachment names (where not specified, these fields may vary as described above):
From: support@games.yahoo.com
Subject: Yahoo! Games
Body:
Yahoo! Team is proud to present our new surprise
for clients of Yahoo! and Yahoo! Mail.
We plan to send you the best Yahoo! Games weekly.
This new service is free and it's a gift for the 5th
anniversary of Yahoo!. We hope that you would like it.
The whole Yahoo! Team want to express our gratitude to
you, the people who help us to improve Yahoo! so much,
that it became the most popular worldwide portal.
Thank You!
We do our best to serve you.
-------------
Yahoo! Team.
www.Yahoo.com
Attachment: Yahoo!Chess.exe
From: support@kefche.com
Subject: kefche.com
Body:
Ekiput na Kefche.com ima radostta da pozdravi vsichki
fenove na Kefcheto s 1-ta godishnina ot puskaneto na site-a.
Nie se prevurnahme v nai-dobriq i poseshtavan bg site
za zabavleniq i igri. Ot samoto si nachalo Kefche.com ima
za cel da vi nosi samo i edinstveno smqh i zabava,
nadqvame se che sme postignali celite si :))
Po sluchai godishninata, ekiput ni poe iniciativata da
izprashta vsqka sedmica nai-dobrite flash-cheta i
igrichki na vsichki user-i poseshtavashti Kefche-to.
Nadqvame se da vi haresa i tova da bude samo nachaloto
na edno novo zabavlenie :))
-----------------
Kefche.com Team.
Subject: Blondinkii
Body:
Hey :)) Kak q karash? Pomnish li me oshte :))
Nadqvam se che da. Baq vreme ne sme sa chuvali..
Neshto novo ima li? Namerih edna mnoo qka programka
i neznam zashto, no mi napomni za teb :))
Kakvo pravi blondinka kato rodi bliznaci? - Chudi se koi e vtoriq tatko :)
Kakva e razlikata mejdu 10 ovce i 3 blondinki? Otgovor: 7
Kak mojesh da razsmeesh blondinka v petak? - Kato i razkajesh vic vav vtornik :)
Kefqt li ta vicovete? Shegichka de :) Razkazva vicove na 5 minuti :))
Posmqh se za baq vreme napred :pPpP Haide bye za sega, i da pishesh :))
Attachment: blondes.exe
Subject: Blondes Forever
Body:
Hey, whatz up :)) Where are you? Don't you chat any more?
I haven't seen you so long. Read this :))
- What do blondes wear behind their ears to attract men? Their ankles!!
- Why did god invent the female orgasm? So blondes know when to stop screwing!!
- What is a blond with hair black colored? Artificial intelligence!
Blondes forever!! :) Time off, i must go now, but i'll be very
happy if you write to me soon :) Bye bye :))
Attachment: blondes.exe
From: greetings@reply.yahoo.com
Subject: %s sent you a Yahoo! Greeting (%s = email name of infected user)
Body:
Surprise! You've just received a Yahoo! Greeting
from "%s" (%s)!
This is an interactive greeting card
and requires Flash Media Player.
Enjoy!
The Yahoo! Greetings Team.
-----------------
Yahoo! Greetings is a free service. If you'd like to send someone a
Yahoo! Greeting, you can do so at http://greetings.yahoo.com
Attachment: Yahoo!Tomcats.exe
From: bg@microsoft.com
Subject: Microsoft Bulgaria
Body:
Blagodarenie na dulgogodishnite tradicii na Microsoft v Bulgaria
i dobrata i suvestna rabota na vsichki neini podchineni, mojem
nai-nakraq da pozdravim bulgarskiq potrebitel s prevod na
Internet Explorer na bulgarski.
Tova e edno uspeshno produljenie na iniciativata za prevejdane na
Ms Office 2000 " na rodniq ni ezik. Update-a e bezplaten i e
podaruk po sluchai 10 godishninata na Microsoft v Bulgaria.
Nadqvame se bulgarskite potrebiteli da ostanat dovolni, koeto shte
bude nai-golemiq podaruk za nas.
---------------------
Microsoft, Bulgaria.
Attachment: IE_0274_bg.exe
From: alert@computel.bg
Subject: Vajno
Body:
Panda Antivirus preduprejdava za nalichieto na nov virus
v internet, narechen W32.Roro@mm. Razprostranqva se predimno
po IRC i chrez zarazeni internet stranici. Sled zarazqvaneto
toi iztriva mp3-ki, filmi i dokumenti.
Poradi golemiq broi zarazeni bulgari prez poslednite
nqkolko dena, Panda Antivirus zapochna razprostranenieto na
patch, koito opravq bug v Internet Explorer 5.5 i minali
versii, pozvolqvasht na stranici sas zlovredno sudurjanie
da izpulnqvat komandi vurhu posetitelite.
Druga nasha preporuka e ako ste veche zarazeni da ne
opitvate da mahate virusa ruchno, a samo s antivirusna
programa, poneje pri neuspeshen opit za premahvane
W32.Roro iztriva razlichni vidove failove na operacionnata
sistema.
------------------
Panda Antivirus, Bulgaria.
www.Computel.bg
Attachment: IE50_032.exe
From: support@winamp.com
Subject: WinAmp Team
Body:
Hello, WinAmp User. WinAmp Team is proud to present our new
surprise for users of WinAmp. WinAmp 3.0 Final has been just
released and we believe that it will be the player you've ever
dreamed about.
We plan to start a new tradition, sending the best skin or
add-on to our users every week. This new service is free and
we hope that you would like it.
Everyone can offer us suggestions.
We do our best to serve you.
----------------
WinAmp Team.
www.WinAmp.com
Attachment: Iguana1.0_skin.exe
From: support@microsoft.com
Subject: Virus Alert
Body:
McAfee Antivirus warns about a new virus, called W32.Roro@mm.
It is a high risk worm and it's using IRC and internet pages
to infect computers. The virus deletes movies, music and
system files.
Due to the significant increase of infected users,
Microsoft Corporation, with the collaboration of
McAfee Antivirus, supports clients of Microsoft Windows
with a patch, which fixes a bug in Internet Explorer 5.5
or minor versions. This bug allows internet pages
to grant access to local resources of visitors.
-----------------
McAfee Antivirus
www.McAfee.com
Attachment: IE_0276_Setup.exe
From: support@yahoo.com
Subject: Yahoo! Toolbar
Body:
Yahoo! Team is proud to present our new surprise
for clients of Yahoo! and Yahoo! Mail.
Yahoo! Toolbar is an innovative technology, which
helps you to access Yahoo! Services easier than ever.
It is free and is a gift for the 5th anniversary of Yahoo!.
We hope that you would like it.
The whole Yahoo! Team want to express our gratitude to you,
the people who help us to improve Yahoo! so much, that it
became the most popular worldwide portal.
Thank You!
We do our best to serve you.
-------------
Yahoo! Team.
www.Yahoo.com
Attachment: Yahoo!Toolbar.exe
Body:
Hello :)) How are you? Do you remember me? I hope so :)) I've just
watched Tomcats, it's marvellous :pP. The summer vacation is over and
this is quite unpleasent :(( I have a lot to tell you about, later..
You can't guess what I've found.. A working Credit Card generator :)))
I purchased a bride from Russia yesterday :) LoL.. I gave a fake address
of course :))) Don't go too far and watch out :)) I'll be very happy
if you write to me soon :))) Bye..
Attachment: [TNT]Gen.exe
Body:
Hi again :)) Where are you? Don't you chat any more? I haven't
seen you so long.. Well, I've got a lot to tell you about. The
Summer vacation was too good to be true. Beach, disco's, friends..
Unfortunately, it's Winter now and the temperatures here are very
low. I was ill almost 2 weeks. Quite unpleasant :(( Let's talk
about you :) Are you oK? Are you in love :)) I sent you a surprise :))
There are cool thoughts, especially about love. It's nice. I'm a
little bit bored of these stupid computers, but I'm waiting for
the reply :)) Bye!
(or similar message body)
One of the following PS lines may be added to the message body:
P.S. Hvarli edno oko na %s :))
P.S. Bqgai na %s mnoo zdravo flash4e ima :pP
P.S. Be happy, don't worry ~pPp. Check this - %s Cool :))
P.S. Have you visited %s :) Co0l :))
(%s = variable name)
In order to spread to users of the Kazaa file sharing network, the worm will create a subfolder "Profiles" in the Windows folder and copy itself in there with various names, built up by joining substrings of various attractive names. Actually, these "copies" embed the body of the virus several times, and their sizes vary accordingly. The "Profiles" subfolder will be shared to other Kazaa users.
When the worm locates mIRC, it will modify one of the files:
- remotes.ini
- controls.ini
- versions.ini
- notes.ini
- url.ini
- version.ini
and add a line in mirc.ini to include that file; the generated script will act as a backdoor server (allowing various remote control commands to be executed on the infected computer).
Under certain conditions, the worm might erase the user's files, including the ones with the following extensions: swf, jpg, mp3, mpg, asf, mov, mpeg, avi, bmp, zip, html, htm, wav, ace, rar, doc, txt, pdf, dos, com, bat, sys, ini, dos.

Last update 21 November 2011

 

TOP