Mabutu comes with an IRC-controlled backdoor component.
Mabutu arrives in a UPX-packed dropper with the main component
as a DLL inside. The main DLL is 49152 bytes in size and is not
packed.
System Infection
Upon execution Mabutu copies itself to the Windows Directory
as <random character>TWAIN.EXE and drops a DLL, which is the body,
as <random character>TWAIN.DLL. The DLL file is added to the registry as
[HKLM\Software\Microsoft\Windows\CurrentVersion\Run]
"winupdt" = "%WindowsDir%\RUNDLL32.EXE <random character>TWAIN.DLL,_mainRD"
%WindowsDir% represents the Windows folder name, for
example C:\Windows on Windows XP systems.
Mabutu keeps its configuration data in an scrambled data file
called cfg.dat in the Windows Directory.
Email Propagation
Mabutu collects email addresses from various places. It checks Windows
Address Book, MSN Messenger Buddy list, Outlook Express mailboxes and
files with the following extensions: .WAB, .HTM, .HTML, .TXT
Using its own SMTP engine Mabutu sends infected messages to the
collected addresses.
Subject is one of:
Hi
Hello
Important
Hello
I'm in love
Sex
Wet girls
I'm nude
Fetishes
gutted
Ok cunt
Attachment names:
britney
jenifer
photo
creme_de_gruyere
with extensions .{JPG|TXT}<lots of spaces>.SCR or .ZIP.
The message body is either a file path, collected from Kazaa Shared Folder
and My Document folders, or one of the following strings:
the_details
the_document
the_message
The mailing routine tests if there is connection to the Internet by
connecting to www.google.com. If the user has a screen saver the worm
waits until it starts then it activates its mass-mailing code.
Payload
The payload in Mabutu is an IRC-controlled backdoor. The backdoor
connects to one of the many predefined IRC servers and after joining
a channel it awaits for commands from its creator. Using these commands
the attacker can get information from the worm (eg. number of sent infected
emails, OS version, etc) and remotely start the mass-mailing routine.
Mabutu has the capability to update itself by downloading and activating
a DLL from a predefined web location.
Detection for this malware was published on July 27th, 2004
in the following F-Secure Anti-Virus updates:
[FSAV_Database_Version]
Version=2004-07-27_01
Write-up:
Katrin Tocheva, July 29th, 2004;
Technical Details:
Gergely Erdelyi, July 29th, 2004;
F-Secure Corporation
