Summary

Enemany is a family of simple e-mail worms created my Energy. By the time of the creation of this description 4 variants were known. All 4 variants are packed with UPX file compressor and are written in Visual Basic. These worms have no payload.

Additional Details

VARIANT:

Enemany.A

This variant is intended as it has a bug that prevents it from sending its file attached to an e-mail. When the worm is run, it shows a fake error message and installs itself to system 3 times:

	C:\WINDOWS\Xerox-Update.Exe
	C:\WINDOWS\SYSTEM\Ati.scr
	C:\WINDOWS\Start Menu\Programs\StartUp\WinUpdate.exe

Then the worm opens Outlook Address Book and tries sends itself to all e-mail addresses found there. The infected message looks like that:

Subject:

	The New Xerox Update for our WinXP

Body:

	Dear,
	Microsoft WinXP User, here are the last Update from Xerox Security System,
	please install this file and going to www.microsoft.com and finished this Update too.

The attachment name should have been 'Xerox-Update.Exe', but the worm tries to attach 'Xerox-Update.exe.exe' file instead and as this file is not found, the worm fails to send itself out.

VARIANT:

Enemany.B

When the worm is run it installs itself to system a 2 times:

	C:\WINDOWS\Esel_Update.Exe
	C:\WINDOWS\SYSTEM\Edonkey.scr

Then the worm creates a startup key for its installed file 'C:\WINDOWS\Esel_Update.Exe' in System Registry:

	\Software\Microsoft\Windows\CurrentVersion\RunServices

Then the worm opens Outlook Address Book and tries sends itself to all e-mail addresses found there. The infected message looks like that:

Subject:

	Edonkey Update

Body:

	Hello Edonkey User,
	this is the Update tool, to fix our Edonkey Client to 35.16.61

Attachment:

	Esel_Update.exe

VARIANT:

Enemany.C

The Enemany.C variant has p-code instead of executable code in its body. When the worm is run it installs itself to system a 2 times:

	C:\WINDOWS\teuro.Exe
        C:\WINDOWS\SYSTEM\Aspi32.scr

Then the worm opens Outlook Address Book and tries sends itself to all e-mail addresses found there. The infected message looks like that:

Subject:

	Alle gegen den TEuro

Body:

	Sieh Dir mal Die Tabelle an,
	mit den neusten Information über den teuren T-Euro

Attachment:

	teuro.exe

VARIANT:

Enemany.D

The Enemany.D variant is actually not a new variant. It's the bugfixed Enamany.A variant - the mass-mailing routine now works. See Enemany.A variant description for more info.

[Analysis: Alexey Podrezov; F-Secure Corp.; June 6th, 2002]