Parent class: VirWare
Viruses and worms are malicious programs that self-replicate on computers or via computer networks without the user being aware; each subsequent copy of such malicious programs is also able to self-replicate. Malicious programs which spread via networks or infect remote machines when commanded to do so by the “owner” (e.g. Backdoors) or programs that create multiple copies that are unable to self-replicate are not part of the Viruses and Worms subclass. The main characteristic used to determine whether or not a program is classified as a separate behaviour within the Viruses and Worms subclass is how the program propagates (i.e. how the malicious program spreads copies of itself via local or network resources.) Most known worms are spread as files sent as email attachments, via a link to a web or FTP resource, via a link sent in an ICQ or IRC message, via P2P file sharing networks etc. Some worms spread as network packets; these directly penetrate the computer memory, and the worm code is then activated. Worms use the following techniques to penetrate remote computers and launch copies of themselves: social engineering (for example, an email message suggesting the user opens an attached file), exploiting network configuration errors (such as copying to a fully accessible disk), and exploiting loopholes in operating system and application security. Viruses can be divided in accordance with the method used to infect a computer:- file viruses
- boot sector viruses
- macro viruses
- script viruses
Class: Email-Worm
Email-Worms spread via email. The worm sends a copy of itself as an attachment to an email message or a link to its file on a network resource (e.g. a URL to an infected file on a compromised website or a hacker-owned website). In the first case, the worm code activates when the infected attachment is opened (launched). In the second case, the code is activated when the link to the infected file is opened. In both case, the result is the same: the worm code is activated. Email-Worms use a range of methods to send infected emails. The most common are: using a direct connection to a SMTP server using the email directory built into the worm’s code using MS Outlook services using Windows MAPI functions. Email-Worms use a number of different sources to find email addresses to which infected emails will be sent: the address book in MS Outlook a WAB address database .txt files stored on the hard drive: the worm can identify which strings in text files are email addresses emails in the inbox (some Email-Worms even “reply” to emails found in the inbox) Many Email-Worms use more than one of the sources listed above. There are also other sources of email addresses, such as address books associated with web-based email services.Read more
Platform: Win32
Win32 is an API on Windows NT-based operating systems (Windows XP, Windows 7, etc.) that supports execution of 32-bit applications. One of the most widespread programming platforms in the world.Description
Technical Details
This is a dangerous worm that spreads via the Internet in infected e-mails. The worm itself is a Windows application written in Delphi and about 370K in size.
Upon being executed (by clicking on the attached file, for instance), it installs itself into the system, registers itself as a service process (hidden application), then sends infected messages (with its attached copy), and, depending on the system date, runs its payload routine.
Installation to System
The worm copies itself to the Windows system directory with a name randomly selected from the following variants:
Play.exe
Bigs as.exe
Zorro.exe
Honey.exe
Jefes.exe
Corte de pelo.exe
Tangas.exe
Canibal.exe
Picadita.exe
Josefina.exe
and registers that file in the Registry auto-run key:
HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun Scorpion=%filename%
E-mail Spreading
The worm sends itself from infected machines as an attached file with random names as above, and with the Subject and message Body randomly selected from the following variants:
Subjects:
Sorpresa !!!
Este si que es un buen presente
Diviertanse
Todo debe estar limpio
Echale un ojo a esto
Buena PECHOnalidad
Con todo mi aprecio
El aguijon de Scorpion
Traseros
Mujeres
Message body:
Abrelo sin miedo que, no es ningun Virus
No tiene ningun Virus
Abrelo no hay PELIGRO, esta limpio de Virus
Mira que bueno esta esto
Espero que esto te guste
Scorpion hace de las suyas
Esto si esta interesante abrelo que no hay peligro
Dime si te gusto
No tiene Virus, asi que abranlo y disfrutenlo
Observa el gran poder de las mujeres en su parte trasera
To send infected messages, the worm connects to a SMTP server. The worm obtains the name of the SMTP server from the default-system settings.
A victim's e-mail addresses are obtained from the WAB file (Windows Address Book). The messages also are sent each time to:
jajachistes@topica.com
tavojaja@yahoogroups.com
cartones@egroups.com
pensamientos@egroups.com
huateque@egroups.com
jacastro@geoline.net
forodelphi2000@yahoo.com.ar
The worm sends e-mails immediately upon the first start-up, then in time intervals, depending on its internal time counters.
Payloads and other
The worm finds and deletes all *.INF and *.SYS files on a drive where Windows is installed, and the system is destroyed due to this in most cases.
Starting in September, and the 15th of each month, the virus runs itself with some video effect.
The worm also creates and modifies the following registry keys:
HKEY_LOCAL_MACHINESoftwareScorpionHelp
Mail = Negro
Fack = Rojo
These keys indicate that: 1st key - e-mail messages have already been sent; 2nd key - INI and SYS files have been deleted.
Depending on its internal time counters, the worm also closes all active application windows, opens/closes the CD drive, blinks the Num/Caps/Scroll-lock keys, an displays 500 messages:
Scorpion ya est� aqu� !!!!
Read more
Find out the statistics of the vulnerabilities spreading in your region on statistics.securelist.com