WORM_STRAT.BG

This worm arrives as attachment to mass-mailed email messages. It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It gathers target email addresses from the Windows Address Book (WAB).

Arrival Details

This worm arrives as attachment to mass-mailed email messages.

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This worm drops the following component file(s):

• %System%\{Random File Name}.dll - also detected as WORM_STRAT.BG
• %System%\e1.dll - also detected as WORM_STRAT.BG
• %System%\{Random File Name}.exe - also detected as WORM_STRAT.BG
• %System%\{Random File Name}.dll - also detected as WORM_STRAT.BG

(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.)

It drops the following non-malicious files:

• %Windows%\serv.s
• %Windows%\serv.wax

(Note: %Windows% is the Windows folder, which is usually C:\Windows or C:\WINNT.)

It drops the following copies of itself into the affected system:

• %Windows%\serv.exe

(Note: %Windows% is the Windows folder, which is usually C:\Windows or C:\WINNT.)

Autostart Technique

This worm adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Serv = "%Windows%\serv.exe s"

It modifies the following registry entry(ies) to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Windows
AppInit_DLLs = "{Random File Name}.dll e1.dll"

Propagation

This worm gathers target email addresses from the Windows Address Book (WAB).

NOTES:

This worm propagates by attaching copies of itself to email messages that it sends to target recipients, using its own Simple Mail Transfer Protocol (SMTP) engine.

Using its own SMTP engine allows it to send email messages without using mailing applications, such as Microsoft Outlook.

The email it sends out has the following details:

Subject: (any of the following)

• Error
• Good day
• hello
• Mail Delivery Sy
• Mail server repo
• Mail Transaction
• picture
• Server Report
• Status
• test

Message body:

Mail server report.

Our firewall determined the e-mails containing worm copies are being sent from your computer.

Nowadays it happens from many computers, because this is a new virus type (Network Worms).

Using the new bug in the Windows, these viruses infect the computer unnoticeably.

After the penetrating into the computer the virus harvests all the e-mail addresses and sends the copies of itself to these e-mail addresses

Please install updates for worm elimination and your computer restoring.

Best regards,
Customers support service

Attachment: (any of the following file names)

• body
• data
• doc
• docs
• document
• file
• message
• readme
• test
• text
• Update-KB{random numbers}-x86

(with any of the following as first extension name)

• DAT
• ELM
• LOG
• MSG
• TXT

(with any of the following as second extension)

• BAT
• CMD
• EXE
• PIF
• SCR
• ZIP

Except for the file name Update-KB{random numbers}-x86, which always uses the .EXE extension, this worm uses double extension names in the attached file (example: BODY.DOC.BAT, DATA.ELM.EXE). The said method of naming may confuse users as to the true file type of the attachment.

Other Details

This worm connects to the following possibly malicious URL:

• http://upgrade.{BLOCKED}net.ne/?version=196644&source=kazaa_336
• http://www2.{BLOCKED}desachlion.co/cgi-bin/a.cgi
• http://www3.{BLOCKED}desachlion.com/cgi-bin/a.cgi
• http://www3.{BLOCKED}desachlion.com/chr/tdg/lt.exe
• http://www4.{BLOCKED}desachlion.co/chr/tdg/lt.exe
• http://www6.{BLOCKED}desachlion.co/chr/tdg/nt.exe