Email-Worm.Win32.Galil

Class Email-Worm
Platform Win32
Description

Technical Details

This is a worm virus spreading via the Internet being attached to infected emails. The worm
consists of several components. All of them are Windows PE EXE files, written in Visual Basic.

 Main file:            "iLLeGaL.exe", about 81K of size
 Spreading component:  "Mplayer.exe", about 14K (compressed by UPX, decompressed - 37K)
 SMTP control:         "SMTP.ocx", about 26K (compressed by UPX, decompressed - 90K)

Installing

When the main worm file is run it installs itself and its components to the system. While
installing the worm copies its main file to the Windows system directory with the name “iLLegGaL.exe”. Other worm components are installed to the same directory. The “Mplayer.exe” component is
then registered in system registry auto-run key:

 HKLMSoftwareMicrosoftWindowsCurrentVersionRunServices
  iLLeGaL = %SystemDir%Mplayer.exe

The worm then displays a fake Flash animation and the message:

 Sorry !
  Looooooooool , thanx fo da time u spent thinkin ov me

Spreading

The worm reads victim emails from the MS Outlook address book and searches for email addresses in
.HTM and .HTML files. To send infected messages the worm uses direct connection to SMTP server.

The infected messages have:

 Subject:  Fwd: Crazy illegal sex !
 Body:     is randomly selected from a file on C: drive
 Attach:   "iLLeGal.exe" or "illegalSex.zip"


The worm activates from infected email only if a user clicks on the attached
file. The worm then installs itself to the system, runs its spreading routine and
payload.

Payload

The worm creates new key (counter) in system registry:

  HKLMiLLeGal

This counter is being increased on each worm start. When the counter reaches ‘5’ the worm
deletes all files on the D: E: F: G: drives and then displays the message:

  ZaCker
   No Peace Without war,i hate war but im forced to love it,Hidden Power's gonna b there wherever u r