F-Secure Virus Descriptions : Wurmark.L

 bx.exe
 bszip.dll
 ANSMTP.DLL

'bx.exe' is a copy of Rbot. 'bszip.dll' and 'ANSMTP.DLL' are used later in e-mail spreading. The work also writes the following files in the Windows system folder:

 cmd.com
 regedit.com
 taskkill.com
 tasklist.com
 tracert.com
 ping.com
 netstat.com

The contents of these files are characters 'MZ'. As 'com' extension is evaluated before 'exe' in Windows program execution, this trick tries to disable the execution of above programs with 'exe' extension.

The worm executes 'bx.exe' which installs itself in system. This file is a variant of Rbot. When 'bx.exe' is run, it copies itself as 'winis.exe' in the Windows system directory and adds the following registry keys:

 [HKLM\Software\Microsoft\Windows\CurrentVersion\Run]
 "IE Runtimes" = "%SysDir%\winis.exe"

This ensures that it will be executed at next system startup. The bot can be used as a backdoor, collecting system information, logging keystrokes, relaying spam and for various other purposes.

The worm also opens a jpg-file from predefined URL. The picture looks like this:

E-mail spreading

Wurmark.L gathers e-mail addresses from the MSN messenger and Yahoo IM client contact lists. The worm uses the dropped SMTP component (ANSMTP.DLL) to send infected messages. It can construct the messages in 7 different languages. The language is selected using the locale of the infected computer.

Here are the possible english messages:

 Attachment Returned
 This file was rejected by the recipient

 You suck!
 I have enclosed why you suck and your not going to like it :@

 My new details
 Hi i've changed email address if you would like to <br>
 keep in contact i have enclosed my new details

 Party Invite!!
 You have been invited to my party <br>
 please download the details and tell me if you <br>
 will be able to make it , Thanks!

Here are the possible german messages:

 Zubeh r Ging
 Diese Akte wurde von der Empf nger zur ckgewiesen

 Sie saugen!
 Ich habe umgeben, warum Sie saugen und Ihr Gehen nicht zu wie ihm :@

 Meine neuen Details
 Hallo nderte ive email address, wenn Sie zu m chten <br>
 Unterhalt im Kontakt habe ich meine neuen Details umgeben

 Beteiligtes Laden!!
 Sie sind zu meinem Beteiligten eingeladen worden <br>
 ddownloaden Sie bitte die Details und erkl ren Sie mir <br>
 wenn Sie in der LageSIND, es zu bilden, Dank!

Here are the possible french messages:

 L'Attachement Est retourn
 Ce dossier a rejet par le destinataire

 Vous sucez!
 J'ai enferm pourquoi vous sucez et votre ne pas aller comme lui :@

 Mes nouveaux d tails
 Bonjour l'ive a chang le email address si vous voudriez <br>
 subsistance en contact j'ai joint mes nouveaux d tails

 La Partie Invitent!!
 Vous avez invit ma partie t chargez <br>
 svp les d tails et me dites si vous pourrez la  <br>
 faire, merci!

Possible italian messages:

 Il Collegamento Ha rinviato
 Questa lima stata rifiutata dal destinatario

 Succhiate!
 Ho accluso perch succhiate e vostro non andare come ad esso :@

 I miei nuovi particolari
 Hi il ive ha cambiato il email address se gradiste a <br>
 conservazione in contatto ho accluso i miei nuovi particolari

 Il Partito Invita!!
 Siete stati invitati al mio partito prego <br>
 trasferite i particolari dal sistema centrale <br>
 verso i satelliti e mi dite se potrete farlo, ringraziamenti!

Possible portuguese messages:

 O Acess rio Retornou
 Esta lima foi rejeitada pelo receptor

 Voc suga!
 Eu inclu porque voc suga e seu n o lhe ir como :@

 Usted aspira!
 He incluido porqu usted aspira y el su no ir como a l :@

 O Partido Convida!!
 Voc foi convidado a meu partido download por <br>
 favor os detalhes e diz-me se voc pudesse  o <br>
 fazer, agradecimentos!

Possible spanish messages:

 El Accesorio Volvi
 Este archivo fue rechazado por el recipiente

 Usted aspira!
 He incluido porqu usted aspira y el su no ir como a l :@

 Mis nuevos detalles
 Hi el ive cambi email address si usted quisiera a <br>
 mantener contacto he incluido mis nuevos detalles

 El Partido Invita!!
 Le han invitado a mi partido descarga por favor <br>
 los detalles y me dice si usted puede hacerlo, <br>
 gracias!

Possible dutch messages:

 Het aanhechtsel Keerde Terug
 Dit bestand werd door de ontvanger afgekeurd

 U zuigt!
 Ik heb waarom u zuigt bijgevoegd en uw gaand alsof het niet :@

 Mijn nieuwe details
 Hi veranderde ive e-mail aanspreekt of u van naar zou houden <br>
 Hou in contact ik heb bijgevoegd mijn nieuwe details bij

 De partij Uitnodig!!
 U bent naar mijn partij alstublieft download de details  <br>
 uitgenodigd worden en vertel mij indien u hem zult kunnen  <br>
 maken, Bedankt!

Attachment name is selected from the following list:

 Party.pif
 File.pif
 Corrupt.pif
 details.pif
 Party.scr
 File.scr
 Corrupt.scr
 details.scr

The file is packed inside 'File.zip' which is the actual attachment in the email.

Back to the Top

Detection

F-Secure Anti-Virus detects Wurmark.L with the following update:

[FSAV_Database_Version]

Version=2005-05-23_02

Back to the Top

Technical Details: Jarkko Turkulainen, May 23th, 2005;

F-Secure Corporation