Threat Description

MyDoom.AE

Details

Aliases:MyDoom.AE, .Mydoom.AA
Category:Malware
Type:Email-Worm
Platform:W32

Summary



A new variant of MyDoom worm - Mydoom.AE, was found on October 16th, 2004. The worm is similar to previous variants. It downloads and executes an additional file from a website. This file is detected as 'Worm.P2P.Scranor'. The Scranor P2P (peer-to-peer) worm in its turn downloads and runs another file, that is detected as 'Backdoor.Win32.Rbot.gen'. The MyDoom.AE worm has a message from Mydoom author(s) to AV vendors.



Removal


Automatic action

Once detected, the F-Secure security product will automatically disinfect the suspect file by either deleting it or renaming it.

More

You may wish to refer to the Support Community for further assistance. You also may also refer to General Removal Instructions for a general guide on alternative disinfection actions.

Eliminating a Local Network Outbreak

If the infection is in a local network, please follow the instructions on this webpage:



Technical Details



The worm is a PE executable file 51712 bytes long packed with UPX file compressor. The unpacked file's size is over 107 kilobytes.

Installation to system

When the worm's file is run, it first creates a mutex named 'My-Game'. Then the worm tries to download a file from the 'www.freewebs.com' website. This file is saved to the root folder of C: drive as 'Scran.exe' and is then activated. The downloaded file is a P2P (peer-to-peer) worm called 'Scranor'.

Upon installation the worm copies itself as 'avpr.exe' file to Windows System Directory and creates a startup key for that file in System Registry:

  • [HKLM\Software\Microsoft\Windows\CurrentVersion\Run] "Avpr" = "%WinSysDir%\avpr.exe"

where "%WinSysDir%" represents Windows System directory. If the startup key cal not be created in HKLM (local machine) Registry tree, it is created in HKCU (current user) tree.

Also the worm creates the following key in the Registry:

  • [HKLM\Software\Microsoft\Windows\DdInfect]

Spreading in e-mails

The worm spreads by sending its infected attachment to all e-mail addresses found on an infected computer. The worm looks for e-mail addresses in Windows Address Book and in the files with the following extensions:

  • wab
  • pl
  • adb
  • tbb
  • dbx
  • asp
  • php
  • sht
  • vbs
  • cfg
  • eml
  • cgi
  • wsh
  • msg
  • uin
  • xls
  • jsp
  • xml
  • mdx
  • mbx
  • html
  • htm
  • txt

The worm searches for these files in the following locations:

  • Desktop folder
  • Temporary Internet Files folder
  • My Documents folder
  • Application Data folders
  • Program Files folders
  • Windows System folder

The files are searched on hard disks and RAM drives from C: to Z:.

The worm avoids sending e-mails to e-mail addresses that contain any of the following substrings:

  • avp
  • syma
  • icrosof
  • panda
  • sopho
  • borlan
  • inpris
  • example
  • mydomai
  • nodomai
  • ruslis
  • .gov
  • gov.
  • .mil
  • foo.
  • berkeley
  • unix
  • math
  • bsd
  • mit.e
  • gnu
  • fsf.
  • ibm.com
  • kernel
  • linux
  • fido
  • usenet
  • iana
  • ietf
  • rfc-ed
  • sendmail
  • arin.
  • ripe.
  • isi.e
  • isc.o
  • acketst
  • pgp
  • tanford.e
  • utgers.ed
  • mozilla
  • root
  • info
  • samples
  • postmaster
  • webmaster
  • noone
  • nobody
  • nothing
  • anyone
  • someone
  • your
  • you
  • me
  • bugs
  • rating
  • site
  • contact
  • soft
  • no
  • somebody
  • privacy
  • service
  • help
  • not
  • submit
  • feste
  • ca
  • gold-certs
  • the.bat
  • page
  • admin
  • icrosoft
  • support
  • ntivi
  • unix
  • bsd
  • linux
  • listserv
  • certific
  • google
  • accoun

The subject of infected e-mails is selected from the following variants:

  • Announcement
  • Details
  • Re:Details
  • Information
  • Re:Information
  • Important
  • Re:Important
  • Fw:Important
  • Document
  • Re:Document
  • Fw:Document
  • Notification
  • Re:Notification
  • Fw:Notification
  • Warning
  • Re:Warning
  • Fw:Warning
  • read now!
  • Information
  • Fw:Information

The body text of infected e-mails is selected from the following variants:

  • Daily Report.
  • your document.
  • here is the document.
  • Reply
  • Important Information.
  • Kill the writer of this document!
  • Details are in the attached document.
  • See the attached file for details
  • Please see the attached file for details
  • Check the attached document.
  • Monthly news report.
  • Please confirm!.
  • Please read the attached file!.
  • Please see the attached file for details.
  • Waiting for a Response. Please read the attachment.
  • Please answer quickly!.

The worm's attachment name is selected from the following variants:

  • document.doc <spaces> .
  • report.doc <spaces> .
  • news.doc <spaces> .
  • msg.doc <spaces> .
  • information.doc <spaces> .
  • letter.doc <spaces> .
  • message.doc <spaces> .
  • file.doc <spaces> .
  • check.doc <spaces> .
  • error.doc <spaces> .
  • archive.doc <spaces> .
  • list.doc <spaces> .
  • data.doc <spaces> .
  • text.doc <spaces> .
  • note.doc <spaces> .
  • notes.doc <spaces> .
  • attachment.doc <spaces> .

The extension of an infected file can be any of the following:

  • .cpl
  • .scr
  • .pif

MyDoom.AE worm can also send itself in a ZIP archive.

The worm can attach a fake anti-virus scanning report to the message it sends:

+++ Attachment: No Virus found
 <av_vendor_string>

where &lt;av_vendor_string&gt; string can be one of the following:

  • +++ MessageLabs AntiVirus - www.messagelabs.com
  • +++ Bitdefender AntiVirus - www.bitdefender.com
  • +++ MC-Afee AntiVirus - www.mcafee.com
  • +++ Kaspersky AntiVirus - www.kaspersky.com
  • +++ Panda AntiVirus - www.pandasoftware.com
  • +++ Norman AntiVirus - www.norman.com
  • +++ F-Secure AntiVirus - www.f-secure.com
  • +++ Norton AntiVirus - www.symantec.com

The worm fakes the sender's address. It uses the following list of names to compose the fake address:

  • Leon
  • Tom
  • Marcus
  • Troy
  • Walter
  • Eric
  • Matthew
  • Kenneth
  • Charles
  • Tommy
  • Jim
  • Francisco
  • Ricky
  • Dennis
  • Scott
  • Jason
  • George
  • Richard
  • Lloyd
  • Jay
  • Leroy
  • Carl
  • Jerry
  • Frank
  • Kevin
  • Donald
  • David
  • Bill
  • Oscar
  • Mario
  • Henry
  • Joshua
  • Jeffrey
  • Anthony
  • Mark
  • William
  • Ronnie
  • Miguel
  • Bernard
  • Douglas
  • Gregory
  • Larry
  • Ronald
  • Paul
  • Michael
  • Jon
  • Clifford
  • Alexander
  • Harold
  • Raymond
  • Jose
  • Brian
  • Daniel
  • Robert
  • Alex
  • Theodore
  • Barry
  • Peter
  • Andrew
  • Timothy
  • Edward
  • Thomas
  • John
  • Calvin
  • Micheal
  • Randall
  • Patrick
  • Stephen
  • Gary
  • Steven
  • JosephJames

The worm uses the following list of domain names to compose the fake sender's address:

  • @microsoft.com
  • @symantec.com

Backdoor component

Upon installation the worm drops a file named 'TCP5424.dll' to Windows System folder. The following startup key is created in the Registry:

  • [HKCR\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InprocServer32] @ = "%WinSysDir%\tcp5424.dll"

where "%WinSysDir%" represents Windows System directory. This DLL file is a backdoor that listens on TCP port 5424 for remote commands. The backdoor allows to upload and activate files on an infected computer.

Payload

The worm modifies the HOSTS file to block access to the following websites:

  • www.pandasoftware.com
  • www.symantec.com
  • securityresponse.symantec.com
  • symantec.com
  • www.sophos.com
  • sophos.com
  • www.mcafee.com
  • mcafee.com
  • liveupdate.symantecliveupdate.com
  • www.viruslist.com
  • viruslist.com
  • viruslist.com
  • f-secure.com
  • www.f-secure.com
  • kaspersky.com
  • www.avp.com
  • www.kaspersky.com
  • avp.com
  • www.networkassociates.com
  • networkassociates.com
  • www.ca.com
  • ca.com
  • mast.mcafee.com
  • my-etrust.com
  • www.my-etrust.com
  • download.mcafee.com
  • dispatch.mcafee.com
  • secure.nai.com
  • nai.com
  • www.nai.com
  • update.symantec.com
  • updates.symantec.com
  • us.mcafee.com
  • liveupdate.symantec.com
  • customer.symantec.com
  • rads.mcafee.com
  • trendmicro.com
  • www.trendmicro.com

Additionally the worm creates the following keys from the Registry:

  • [HKLM\Software\Microsoft\Windows\CurrentVersion\Run] "MsnMsgr" "ICQ Net"

The message to AV vendors

The worm contains a message to AV vendors in its body:

Lucky's Av's ;P~. Sasser author gets IT security job and we will
 work with Mydoom , P2P worms and exploit codes .Also we will
 attack f-secure,symantec,trendmicro,mcafee , etc. The 11th of
 march is the skynet day lol . When the beagle and mydoom loose,
 we wanna stop our activity <== so Where is the Skynet now? lol.
 This Will Drop W32.Scran P2P Worm

This message is extracted by the worm to Windows System folder as 'msg15.txt' file.






SUBMIT A SAMPLE

Suspect a file or URL was wrongly detected? Submit a sample to our Labs for analysis

Submit Now

Give And Get Advice

Give advice. Get advice. Share the knowledge on our free discussion forum.

Learn More