Home / malware

PDF

Win32.Mydoom.B@mm (Win32.Novarg.B@mm)

First posted on 21 November 2011.
Source: BitDefender

Aliases :

Win32.Mydoom.B@mm (Win32.Novarg.B@mm) is also known as I-Worm.Mydoom.b, W32/Mydoom.b@MM, W32/MyDoom-B.

Explanation :

This is an internet worm that spreads trough e-mail and file sharing programs and has backdoor capabilities.

It also tries to infect computers in the local network already infected by the former variant of the worm, by using the backdoor already installed on port 3127.

The e-mail arrives in the following format:

From:
A random text or an address with one of the following domains:
aol.com
msn.com
yahoo.com
hotmail.com
Subject:
Randomly chosen from the following list:
Mail Transaction Failed
Unable to deliver the message
Status
Delivery Error
Mail Delivery System
hello
Error
Server Report
Returned mail
Body text:
A random text or one of the following:
test
The message cannot be represented in 7-bit ASCII encoding and has been sent as a binary attachment.
sendmail daemon reported: Error #804 occured during SMTP session. Partial message has been received.
The message contains Unicode characters and has been sent as a binary attachment.
The message contains MIME-encoded graphics and has been sent as a binary attachment.
Mail transaction failed. Partial message is available.
Attachment:
A file with document icon and executable extension (pif, cmd, bat, scr, exe) with one of the following names:
body
doc
text
document
data
file
readme
message
The virus terminates the process TASKMON.EXE if it is running.

It uses a mutex called sync-v1.01__ipcmtx0 to avoid multiple running instances.

It 80% of cases it opens Notepad with a file with random data:



and in 20% of cases it shows a fake error message:



The backdoor is installed in the Windows System folder with the name CTFMON.DLL listening to one of the following ports: 1080, 3128, 80, 8080, 10080.

After 1st of March 2004, the worm stops spreading, but the backdoor remains installed and listening.

A copy of the virus named EXPLORER.EXE is created in the Windows System folder and the registry entry is created, so that Windows will load the worm each time:

HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun
with the value:
Explorer = %SYSDIR%EXPLORER.EXE

Also, the worm creates another registry key for the backdoor to load with Windows each time:

HKEY_CLASSES_ROOTCLSID{E6FB5E20-DE35-11CF-9C87-00AA005127ED}InProcServer32
with the value:
(default) = %SYSDIR%CTFMON.DLL

On Windows NT, 2000, XP or 2003, the hosts file (%SYSDIR%driversetchosts) is modified so as the user won't be able to connect to the following hosts:

engine.awaps.net
awaps.net
www.awaps.net
ad.doubleclick.net
spd.atdmt.com
atdmt.com
click.atdmt.com
clicks.atdmt.com
media.fastclick.net
fastclick.net
www.fastclick.net
ad.fastclick.net
ads.fastclick.net
banner.fastclick.net
banners.fastclick.net
www.sophos.com
sophos.com
ftp.sophos.com
f-secure.com
www.f-secure.com
ftp.f-secure.com
securityresponse.symantec.com
www.symantec.com
symantec.com
service1.symantec.com
liveupdate.symantec.com
update.symantec.com
updates.symantec.com
support.microsoft.com
downloads.microsoft.com
download.microsoft.com
windowsupdate.microsoft.com
office.microsoft.com
msdn.microsoft.com
go.microsoft.com
nai.com
www.nai.com
vil.nai.com
secure.nai.com
www.networkassociates.com
networkassociates.com
avp.ru
www.avp.ru
www.kaspersky.ru
www.viruslist.ru
viruslist.ru
avp.ch
www.avp.ch
www.avp.com
avp.com
us.mcafee.com
mcafee.com
www.mcafee.com
dispatch.mcafee.com
download.mcafee.com
mast.mcafee.com
www.trendmicro.com
www3.ca.com
ca.com
www.ca.com
www.my-etrust.com
my-etrust.com
ar.atwola.com
phx.corporate-ir.net
www.microsoft.com
In 80% of cases, after February 1st, 2004 (13:09:18), the virus attempts to attack the website www.sco.com (using the main thread and 7 additional threads).

Otherwise, in 70% of cases, after February 3rd, 2004 (16:09:18), the virus attempts to attack the website www.microsoft.com (using the main thread and 13 additional threads).

Attack details:
the threads attempt to get the home page of those sites by sending a HTTP GET command
the priority of the threads is set to "below normal"
once the main thread sends the request, the virus loops (recreates the other threads, etc).
However, as www.microsoft.com is one of the hosts that are prevented to be accessed (by modifying the Windows hosts file), it won't be attacked by the systems that run Windows NT, 2000, XP or 2003.

It copies itself to the Kazaa shared folder under the following names, and an executable extension:

NessusScan_pro
attackXP-1.26
winamp5
MS04-01_hotfix
zapSetup_40_148
BlackIce_Firewall_Enterpriseactivation_crack
xsharez_scanner
icq2004-final
The worm searches for e-mails in files with one of these extensions:
.adb
.asp
.dbx
.htm
.php
.pl
.sht
.tbb
.txt
.wab
First it searches the Temporary Internet Files for ensuring a fast initial spreading, and after that on all fixed drives it finds, skipping e-mail addresses that contains the following:

abuse, accoun, certific, listserv, ntivi, icrosoft, admin, page, the.bat, gold-certs, feste, submit, help, service, privacy, somebody, soft, contact, site, rating, bugs, your, someone, anyone, nothing, nobody, noone, webmaster, postmaster, support, samples, info, root, ruslis, nodomai, mydomai, example, inpris, borlan, nai., sopho, foo., .mil, gov., .gov, panda, icrosof, syma, kasper, mozilla, utgers.ed, tanford.e, acketst, secur, isc.o, isi.e, ripe., arin., sendmail, rfc-ed, ietf, iana, usenet, fido, linux, kernel, google, ibm.com, fsf., mit.e, math, unix, berkeley, spam

The worm contains the following string (never displayed):
(sync-1.01; andy; I'm just doing my job, nothing personal, sorry)

Last update 21 November 2011

 

TOP