Mitglieder.H is a descendant of the Mitglieder trojan family with
the ability to spread to computers infected with the Mydoom.A worm.
The main payload of the worm is a backdoor / SMTP proxy that
listens on TCP port 35555. The payload includes other parts like
disabling antivirus software and reporting of infected computers.
When run, the worm copies itself as SYSTEM.EXE to the
Windows System directory and creates the following entry in the
"ssgrate.exe" = "%winsysdir%\system.exe"
where %winsysdir% is the name of Windows System directory.
It also creates another key in the Registry where it
stores its internal variables:
To spread Mitglieder.H scans random IP addresses for open TCP port
3127. Exploiting the backdoor installed by Mydoom.A it copies
itself to those hosts.
Backdoor and SMTP proxy
The main component of the payload is a TCP backdoor / SMTP proxy
that listens on port 35555. Through the backdoor a remote attacker
can instruct the infected computer to build up a TCP connection
and relay the traffic.
The backdoor component uses a list of URLs to PHP files where it
reports the address of the infected computer along with the port
number where the backdoor is sitting.
Disabling Security Software
The payload of Mitglieder.H contains a thread that terminates
processes with the following names:
The worm contains several HTTP links that is uses to download and
execute programs. At this moment the links are inaccessible so the
worm will not download anything.
Detection in F-Secure Anti-Virus was published on February 12th, 2004
Gergely Erdelyi and Alexey Podrezov; February 12th, 2004;