Name :	Banwarum.A
Category:	Malware
Type:	Backdoor, Email-Worm
Platform:	W32

The first Banwarum worm variant was found at the end of May 2006. Shortly after, there appeared two slightly different variants. Banwarum worm spreads in e-mail messages with different German subjects and body texts. Some of the worm's messages are similar to those sent by the Sober worm. The worm has backdoor functionality.

Installation to System

The worm's file is a PE executable. When run, it drops the main worm's component to Windows System directory as the file mszsrn32.dll. This file is then injected into the winlogon.exe process. When the DLL file is activated, it creates a startup key for itself in Windows Registry:

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

The registered module name is 'mszsrn32'. As a result the worm's DLL will get control before a user logs onto Windows.


Spreading in E-mails

Before spreading the worm scans for e-mail addresses. It scans all drives from C: to Z: except CD-ROMs for files with the following extensions:
The worm ignores e-mail addresses if they contain any of the following substrings:
The worm composes different e-mail messages. All of the messages that the worm sends out are in German. The subjects of these e-mails can be any of the following:
Here are a few examples of message body texts that the worm uses:






Attachment names can contain any of the following strings:
The attachment can be an executable with a double extension or an archive created by either 7-zip, WinAce, or WinRar archivers.


Payload

The worm has backdoor capabilities. It connects to one of these sites:
The backdoor reports to the site: its ID, uptime, version, operating system type, and some other info. Also, the backdoor part can receive commands from a hacker and do any of the following:


Origin

The worm was named by its author as 'Win32.Zasrancheg'. It should be noted that the word 'zasrancheg' is in Russian, but is modified according to more recent slang. So it's almost certain that the creator of the worm is of Russian origin.