Email-Worm.Win32.Rastam

Class Email-Worm
Platform Win32
Description

Technical Details

This is Internet worm spreading with emails by affecting Eudora email client.

The infected message arrives with the text “Help us go back to home!” at the end of the message body and attached DOS COM file “www.back2afrika.com” (the virus tries to cheat an user by disguising its .COM extension with URL-like name).

If user activates the attached COM file, the worm gets control, creates EXE file with random name in temporary directory, and runs it. That EXE file is PE EXE file and contains main worm routine which registers worm text and
attachment as Eudora auto-signature. As a result all outgoing mails will have worm text and attached COM file (see above) pasted to the end of the message.

The worm code contains the text strings:

RASTAMAN
SOFTWARECLIENTSMAILEUDORASHELLOPENCOMMAND
EUDORA.INI
Use
Signature
Settings
Help us go back to home!
begin 644 www.back2afrika.com
Haile Selassie is Jesus Christ!
(tehporp sih si anceV dnA)

Last string is “And Vecna is his prophet” written backwards.

The known worm version has a bug and can’t spread.