Home / malware

PDF

Delf.V

First posted on 31 August 2006.
Source: SecurityHome

Aliases :

Delf.V is also known as W32/Sixem-A, Email-Worm.Win32.Delf.v, W32.Sixem.A@mm.

Explanation :

Delf.V is a mass-mailing worm that sends out FIFA World Cup (Football/Soccer) related e-mails. It contains subjects such as "Soccer fans killed five teens" and "Crazy soccer fans".

Delf.V is a mass-mailing worm that sends out FIFA World Cup (Football/Soccer) related e-mails.

Installation to the System

Delf.V copies itself to the Windows system folder as a file named: msctools.exe.

It Installs the following registry launch points:
"nsdevice" = "%SysDir%msctools.exe"
[HKLMSoftwareMicrosoftWindowsCurrentVersionRun]
"nsdevice" = "%SysDir%msctools.exe"
[HKLMSoftwareMicrosoftWindowsCurrentVersionRunServices]
"nsdevice" = "%SysDir%msctools.exe"
[HKCUSoftwareMicrosoftWindowsCurrentVersionRun]
%SysDir% represents the Windows System Folder.

The mutex used by Delf.V is named "dezas".


Spreads via E-mail

Delf.V collects e-mail addresses from the following list of file extensions:
adb
dbx
doc
eml
htm
html
mbx
mdx
msg
nch
not
oft
rtf
sht
tbb
tbi
txt
wab
xls
xml
Addresses are discarded if they contain one of the following keywords:
.edu
.gov
.mil
abuse
addres
admin
anonymous
anti
anyone
aol
apache
avp
berkeley
borlan
bsd
bug
certific
contact
cops
defend
echo
example
fbi
fido
foo.
google
gov.
help
ibm.com
icrosof
info
inpris
kaspersk
kernel
linux
local
mcafee
microsof
mozilla
mydomai
nobody
nodomai
norton
not
nothing
page
panda
pgp
policy
postmaster
privacy
random
reply
report
ripe.
root
samples
secur
sendmail
service
spam
submit
support
symantec
user
virus
webmaster
webmin
webmist
The harvested addresses are saved as two files named cats.jpg and cats2.jpg.
Delf.V tries to post the addresses to [***]traf.com/ms/count.php. It also tries to download and execute a file from http://couple[***].com/tumbs/dianaimg.exe.

Delf.V e-mail contains the following characteristics:

Sender:
hotnews@cnn.com
kellyjast@hotmail.com
lindasal@gmail.com
mr.robs@yahoo.com
newsreader@hotmail.com
todaynews@cnn.com
Subjects:
Crazy soccer fans
My sister whores, sh[*]t i dont know
My tricks for you
Naked World Cup game set
Please reply me Tomas
Soccer fans killed five teens
Body Texts:
Crazy soccer fans killed two teens, watch what they make on photos. Please report on this all who know.
Emily Carr was an artist known for her prudery, but now the Portrait Gallery of Canada has acquired a nude self-portrait. View photos.
Halo Markus, i sent my nude pics. Please reply me with you nude photos ;). Best regard You Sweet Kitty
I wait you photos from New York. I sent my pics where i naked for you. Please reply me. Linda Salivan
Nudists are organising their own tribute to the world cup, by staging their own nude soccer game, though it is not clear how the teams will tell each other apart. Good photos ;)
Soccer fans killed five teens, watch what they make on photos. Please report on this all who know.
Attachement Names:
emily_selfphoto.jpg.exe
kelly_nude_imgs.jpg.exe
linda_bigtit.gif.exe
soccer_fans.jpg.exe
soccer_nudist.bmp.exe
soccer_pics.jpg.exe

Last update 31 August 2006

 

TOP