Threat Description

Wurmark.L

Details

Aliases: Wurmark.L, Email-Worm.Win32.Wurmark.l
Category: Malware
Type: Worm
Platform: W32

Summary



Wurmark.L is an e-mail worm that spreads using several different languages. It also drops a variant of Rbot on the infected system.



Removal



Automatic Disinfection

Allow F-Secure Anti-Virus to disinfect the relevant files.

For more general information on disinfection, please see Removal Instructions.



Technical Details



Installation to system

When run, the worm drops the following three files from its resource:

bx.exe
 bszip.dll
 ANSMTP.DLL
 

'bx.exe' is a copy of Rbot. 'bszip.dll' and 'ANSMTP.DLL' are used later in e-mail spreading. The work also writes the following files in the Windows system folder:

cmd.com
 regedit.com
 taskkill.com
 tasklist.com
 tracert.com
 ping.com
 netstat.com
 

The contents of these files are characters 'MZ'. As 'com' extension is evaluated before 'exe' in Windows program execution, this trick tries to disable the execution of above programs with 'exe' extension.

The worm executes 'bx.exe' which installs itself in system. This file is a variant of Rbot. When 'bx.exe' is run, it copies itself as 'winis.exe' in the Windows system directory and adds the following registry keys:

[HKLM\Software\Microsoft\Windows\CurrentVersion\Run]
 "IE Runtimes" = "%SysDir%\winis.exe"
 

This ensures that it will be executed at next system startup. The bot can be used as a backdoor, collecting system information, logging keystrokes, relaying spam and for various other purposes.

The worm also opens a jpg-file from predefined URL. The picture looks like this:

E-mail spreading

Wurmark.L gathers e-mail addresses from the MSN messenger and Yahoo IM client contact lists. The worm uses the dropped SMTP component (ANSMTP.DLL) to send infected messages. It can construct the messages in 7 different languages. The language is selected using the locale of the infected computer.

Here are the possible english messages:

Attachment Returned
 This file was rejected by the recipient


 You suck!
 I have enclosed why you suck and your not going to like it :@


 My new details
 Hi i've changed email address if you would like to <br>
 keep in contact i have enclosed my new details


 Party Invite!!
 You have been invited to my party <br>
 please download the details and tell me if you <br>
 will be able to make it , Thanks!
 

Here are the possible german messages:

Zubeh r Ging
 Diese Akte wurde von der Empf nger zur ckgewiesen


 Sie saugen!
 Ich habe umgeben, warum Sie saugen und Ihr Gehen nicht zu wie ihm :@


 Meine neuen Details
 Hallo nderte ive email address, wenn Sie zu m chten <br>
 Unterhalt im Kontakt habe ich meine neuen Details umgeben


 Beteiligtes Laden!!
 Sie sind zu meinem Beteiligten eingeladen worden <br>
 ddownloaden Sie bitte die Details und erkl ren Sie mir <br>
 wenn Sie in der LageSIND, es zu bilden, Dank!
 

Here are the possible french messages:

L'Attachement Est retourn
 Ce dossier a rejet par le destinataire


 Vous sucez!
 J'ai enferm pourquoi vous sucez et votre ne pas aller comme lui :@


 Mes nouveaux d tails
 Bonjour l'ive a chang le email address si vous voudriez <br>
 subsistance en contact j'ai joint mes nouveaux d tails


 La Partie Invitent!!
 Vous avez invit ma partie t chargez <br>
 svp les d tails et me dites si vous pourrez la  <br>
 faire, merci!
 

Possible italian messages:

Il Collegamento Ha rinviato
 Questa lima stata rifiutata dal destinatario


 Succhiate!
 Ho accluso perch succhiate e vostro non andare come ad esso :@


 I miei nuovi particolari
 Hi il ive ha cambiato il email address se gradiste a <br>
 conservazione in contatto ho accluso i miei nuovi particolari


 Il Partito Invita!!
 Siete stati invitati al mio partito prego <br>
 trasferite i particolari dal sistema centrale <br>
 verso i satelliti e mi dite se potrete farlo, ringraziamenti!
 

Possible portuguese messages:

O Acess rio Retornou
 Esta lima foi rejeitada pelo receptor


 Voc suga!
 Eu inclu porque voc suga e seu n o lhe ir como :@


 Usted aspira!
 He incluido porqu usted aspira y el su no ir como a l :@


 O Partido Convida!!
 Voc foi convidado a meu partido download por <br>
 favor os detalhes e diz-me se voc pudesse  o <br>
 fazer, agradecimentos!
 

Possible spanish messages:

El Accesorio Volvi
 Este archivo fue rechazado por el recipiente


 Usted aspira!
 He incluido porqu usted aspira y el su no ir como a l :@


 Mis nuevos detalles
 Hi el ive cambi email address si usted quisiera a <br>
 mantener contacto he incluido mis nuevos detalles


 El Partido Invita!!
 Le han invitado a mi partido descarga por favor <br>
 los detalles y me dice si usted puede hacerlo, <br>
 gracias!
 

Possible dutch messages:

Het aanhechtsel Keerde Terug
 Dit bestand werd door de ontvanger afgekeurd


 U zuigt!
 Ik heb waarom u zuigt bijgevoegd en uw gaand alsof het niet :@


 Mijn nieuwe details
 Hi veranderde ive e-mail aanspreekt of u van naar zou houden <br>
 Hou in contact ik heb bijgevoegd mijn nieuwe details bij


 De partij Uitnodig!!
 U bent naar mijn partij alstublieft download de details  <br>
 uitgenodigd worden en vertel mij indien u hem zult kunnen  <br>
 maken, Bedankt!
 

Attachment name is selected from the following list:

Party.pif
 File.pif
 Corrupt.pif
 details.pif
 Party.scr
 File.scr
 Corrupt.scr
 details.scr
 

The file is packed inside 'File.zip' which is the actual attachment in the email.



Detection


F-Secure Anti-Virus detects Wurmark.L with the following update:
Detection Type: PC
Database: 2005-05-23_02



Technical Details: Jarkko Turkulainen, May 23th, 2005


SUBMIT A SAMPLE

Suspect a file or URL was wrongly detected? Submit a sample to our Labs for analysis

Submit Now

Disinfect your PC

F-Secure Anti-Virus will disinfect your PC and remove all harmful files

Learn More