Kaspersky Threats — BadtransII

Parent class: VirWare

Viruses and worms are malicious programs that self-replicate on computers or via computer networks without the user being aware; each subsequent copy of such malicious programs is also able to self-replicate. Malicious programs which spread via networks or infect remote machines when commanded to do so by the “owner” (e.g. Backdoors) or programs that create multiple copies that are unable to self-replicate are not part of the Viruses and Worms subclass. The main characteristic used to determine whether or not a program is classified as a separate behaviour within the Viruses and Worms subclass is how the program propagates (i.e. how the malicious program spreads copies of itself via local or network resources.) Most known worms are spread as files sent as email attachments, via a link to a web or FTP resource, via a link sent in an ICQ or IRC message, via P2P file sharing networks etc. Some worms spread as network packets; these directly penetrate the computer memory, and the worm code is then activated. Worms use the following techniques to penetrate remote computers and launch copies of themselves: social engineering (for example, an email message suggesting the user opens an attached file), exploiting network configuration errors (such as copying to a fully accessible disk), and exploiting loopholes in operating system and application security. Viruses can be divided in accordance with the method used to infect a computer:

file viruses
boot sector viruses
macro viruses
script viruses

Any program within this subclass can have additional Trojan functions. It should also be noted that many worms use more than one method in order to spread copies via networks.

Class: Email-Worm

Email-Worms spread via email. The worm sends a copy of itself as an attachment to an email message or a link to its file on a network resource (e.g. a URL to an infected file on a compromised website or a hacker-owned website). In the first case, the worm code activates when the infected attachment is opened (launched). In the second case, the code is activated when the link to the infected file is opened. In both case, the result is the same: the worm code is activated. Email-Worms use a range of methods to send infected emails. The most common are: using a direct connection to a SMTP server using the email directory built into the worm’s code using MS Outlook services using Windows MAPI functions. Email-Worms use a number of different sources to find email addresses to which infected emails will be sent: the address book in MS Outlook a WAB address database .txt files stored on the hard drive: the worm can identify which strings in text files are email addresses emails in the inbox (some Email-Worms even “reply” to emails found in the inbox) Many Email-Worms use more than one of the sources listed above. There are also other sources of email addresses, such as address books associated with web-based email services.

Read more

Platform: Win32

Win32 is an API on Windows NT-based operating systems (Windows XP, Windows 7, etc.) that supports execution of 32-bit applications. One of the most widespread programming platforms in the world.

Description

Technical Details

This is a worm that spreads under Win32 systems. The virus sends e-mail messages with infected files attached, as well as installs a spying Trojan component to steal information from infected systems. The worm was discovered in-the-wild in November 2001.

The worm itself is a Win32 executable file (PE EXE file). It was found in-the-wild in compressed form, and is about 29Kb in size. Upon being decompressed, the worm file length becomes about 60Kb in size.

The worm consists of two main components, the Worm and Trojan. The "Worm" component sends infected messages, and the "Trojan" component sends out information (user's info, RAS data, cached passwords, keyboard log) from infected computers to a specified e-mail address. It also keeps a "keylogger" program body in its code, and installs it into the system while infecting a new machine.

Infecting the system

When an infected file is run (when a user clicks on an attached file and activates it, or if the worm gains control through an IFRAME security breach), the worm code gains control. First of all, it drops (installs) its components to the system and registers in the system registry.

The installed Trojan file-name, the target directory and registry key are optional. They are stored in encrypted form in the Trojan file at the file end. A hacker may configure them before sending them to a victim's machine, or before putting it on a Web site.

The worm also drops an additional keyboard hooker (Win32 DLL file) to the system, and then uses this to spy on text entered by a keyboard. The DLL file name is optional as well.

Other optional features are:

- the worm deletes original infected file when installation is complete
- the size of keyboard log file

Spreading

To send infected messages, the worm uses a direct connection to an SMTP server. A victim's e-mail addresses are obtained in two different ways:

#1. The worm scans *.HT* and *.ASP files and extracts e-mail addresses from here
#2. The worm, using MAPI functions, reads all e-mail from the incoming box, and obtains e-mail addresses from here.

Next, the worm sends infected messages. The message body contains HTML format, and uses an IFRAME breach to spawn an infected attachment on vulnerable machines.

The message fields are as follows:

From: - original sender, or fake address, randomly selected from:

" Anna"
"JUDY"
"Rita Tulliani"
"Tina"
"Kelly Andersen"
" Andy"
"Linda"
"Mon S"
"Joanna"
"JESSICA BENAVIDES"
" Administrator"
" Admin"
"Support"
"Monika Prado"
"Mary L. Adams"
" Anna"
"JUDY"
"Tina"

The original sender address is a bit modified: the "_" character is inserted before the e-mail address in there, for example:

"John K. Smith" "Vasja Pupkin" - original address
"John K. Smith" <_john123@yahoo.com> "Vasja Pupkin" <_vasyap@rambler.ru> - sent by worm
Subject: empty, or "Re:", or "Re:" followed by original Subject from real Inbox messsage (see #2 above)
Body: empty
Attachment: randomly selected "filename + ext1 + ext2" where:
"Filename":
 Pics      (or PICS )                  Card     (or CARD)
 images    (or IMAGES)                 Me_nude  (or ME_NUDE)
 README                                Sorry_about_yesterday
 New_Napster_Site                      info
 news_doc  (or NEWS_DOC)               docs   (or DOCS)
 HAMSTER                               Humor  (or HUMOR)
 YOU_are_FAT! (or YOU_ARE_FAT!)        fun    (or FUN)
 stuff                                 SEARCHURL
 SETUP                                 S3MSONG

 "ext1": .DOC .ZIP .MP3
 "ext2":  .scr, .pif
For example: "info.DOC.scr"
The worm doesn't send infected messages twice to the same address. To do this, it stores all infected e-mails in the Windows system directory in a PROTOCOL.DLL file, and checks this file content before sending a new message.

Spying Trojan

This routine stores stolen information to a log file (with an optional name), and encrypts this information with a key (also optional). After a period of time, this information is sent to one of a number of randomly selected e-mail addresses. A list of these addresses appears below; the list contains 22 addresses and e-mail servers; and these messages are sent through (email + server):

 ZVDOHYIK@yahoo.com               mx2.mail.yahoo.com
 udtzqccc@yahoo.com               mx2.mail.yahoo.com
 DTCELACB@yahoo.com               mx2.mail.yahoo.com
 I1MCH2TH@yahoo.com               mx2.mail.yahoo.com
 WPADJQ12@yahoo.com               mx2.mail.yahoo.com
 fjshd@rambler.ru                 mail5.rambler.ru
 smr@eurosport.com                mail.ifrance.com
 bgnd2@canada.com                 mail.canada.com
 muwripa@fairesuivre.com          fs.cpio.com
 rmxqpey@latemodels.com           inbound.latemodels.com.criticalpath.net
 eccles@ballsy.net                inbound.ballsy.net.criticalpath.net
 suck_my_prick@ijustgotfired.com  mail.monkeybrains.net
 suck_my_prick4@ukr.net           mail.ukr.net
 thisisno_fucking_good@usa.com    usa-com.mr.outblaze.com
 S_Mentis@mail-x-change.com       mail-fwd.rapidsite.net
 YJPFJTGZ@excite.com              mta.excite.com
 JGQZCD@excite.com                mta.excite.com
 XHZJ3@excite.com                 mta.excite.com
 OZUNYLRL@excite.com              mta.excite.com
 tsnlqd@excite.com                mta.excite.com
 cxkawog@krovatka.net             imap.front.ru
 ssdn@myrealbox.com               smtp.myrealbox.com

Found In-The-Wild

This worm variant found in-the-wild on November 24, 2001 has the following options:

It installs itself to a Windows system directory with the KERNEL32.EXE name, and registers it in the following registry key:

HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRunOnce Kernel32 = kernel32.exe

It drops a keyboard hooker with the KDLL.DLL name. The log info is stored in the Windows system directory with the CP_25389.NLS name.

Find out the statistics of the vulnerabilities spreading in your region on statistics.securelist.com

Found an inaccuracy in the description of this vulnerability? Let us know!