Hello DavidR,
I do not know what the situation is right now, because yes it is critical for both the damage potential and distribution potential of this worm, is mentioned as high. Propagation is both via email and peer2peer networks. The propagation technique is similar to that of WORM BAGLE, the vector this time is malicious JavaScript in stead of a trojan dropper. The said JavaScript is found up as JS FEEBS.AF. It sends copies of aforementioned script through its own smtp-engine, and also drops copies in ZIP.archives with the string DOWNLOADS inside to other target systems in an affected peer2peer network.
The actual technical details for Arrival and Installation
This memory-resident worm arrives on an affected system as a file downloaded from the Internet by a malicious JavaScript, which Trend Micro detects as JS_FEEBS.AF. Upon execution, it drops the following files in the Windows system folder:
* Ms{two random characters} - copy of itself
* Ms{two random characters}.exe - copy of itself
* Ms{two random characters}32.dll - also detected as WORM_FEEBS.AF
This worm injects Ms{two random characters}32.dll into EXPLORER.EXE to hide its process. Once it successfully injects the said file, it then ensures its automatic execution at every system startup. It does the said actions by creating the following registry entries, respectively:
HKEY_LOCAL_MACHINE\SOFTWARE\Classes
CLSID{random CLSID}\InprocServer32
@ = “%System%\Ms{two random characters}32.dll”
(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft
Windows\CurrentVersion\ShellServiceObjectDelayLoad
Ms{two random characters}32.dll = “{random CLSID}”
Furthermore, it adds the following registry keys as part of its installation routine:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft
MS{two random characters}\dat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft
MS{two random characters}\sdat
For Propagation Routines
This worm employs a propagation technique similar to that used by certain WORM_BAGLE variants. Its difference lies in its usage of a malicious JavaScript instead of a Trojan to download copies of itself from a certain location onto the affected system. The said JavaScript is detected by Trend Micro as JS_FEEBS.AF. Once this worm executes, it sends out copies of JS_FEEBS.AF to target recipients via email using its own Simple Mail Transfer Protocol (SMTP) engine. Through this SMTP engine, it is able to easily send email messages even without using other mailing applications.
The said email message it sends out has the following details:
From: Id{random number} (appended with any of the following)
• @aol.com
• @gmail.com
• @hotmail.com
• @msn.com
• @yahoo.com
Subject: (any combination from the three sets listed below)
Set 1
• Encrypted
• Extended
• Protected
• Secure
Set 2
• E-mail
• Html
• Mail
• Message
Set 3
• {none}
• From {random domain name} user
• Service
• Service {random domain name}
• System
Message body:
Subject: happy new year
ID: {random}
Password: {random}
Message is attached.
Best Regards,
{Same name as the From field},
{Same domain name as the From field}
Attachment: (any of the following)
• data.zip
• mail.zip
• message.zip
• msg.zip
The attachment of the spammed email message contains an .HTA file, which is actually a copy of JS_FEEBS.AF. The name of the said .HTA file is any combination from the two sets listed below:
* Set 1
o Encrypted
o Extended
o Protected
o Secure
* Set 2
o E-mail
o Html
o Mail
o Message
This worm also drops any of the following .ZIP archives into folders containing the string DOWNLOADS:
* 3dsmax_9_(3D_Studio_Max)_new!_full+crack.zip
* ACDSee_9_new!_full+crack.zip
* Adobe_Photoshop_10_(CS3)_new!_full+crack.zip
* Adobe_Premiere_9_(2.0_pro)_new!_full+crack.zip
* Ahead_Nero_8_new!_full+crack.zip
* DivX_7.0_new!_full+crack.zip
* ICQ_2006_new!_full+crack.zip
* Internet_Explorer_7_new!_full+crack.zip
* Kazaa_4_new!_full+crack.zip
* Longhorn_new!_full+crack.zip
* Microsoft_Office_2006_new!_full+crack.zip
* winamp_5.2_new!_full+crack.zip
The abovementioned .ZIP archives contain the following files:
* webinstall.exe - copy of this worm
* {File name of the .ZIP file without the string _new!_full+crack}.txt - a non malicious text file
This worm is working under the assumption that folders with the said string are folders shared within peer-to-peer (P2P) networks. By dropping its copies on the said locations, it may extend its propagation reach to other targets systems within the affected P2P network. Note that the file names used by this worm’s dropped copies are like the names of popular applications, which may trick an affected user into thinking that the said files are not threats to the system.
Affected Platforms
This worm runs on Windows 98, ME, NT, 2000, XP, and Server 2003. The worm was detected by Trend-Micro in January of this year.
polonus
