Home > Threat descriptions >

Eyeveg.f

Classification

Category: Malware

Type: -

Aliases: Worm.Win32.Eyeveg.f, W32/Eyeveg.H@mm, W32/Eyeveg.worm.gen, WORM_WURMARK.J

Summary


Eyeveg.f is a network worm with password stealing, backdoor capabilities and email spreading functionality.

Removal


Automatic action

Based on the settings of your F-Secure security product, it will either automatically delete, quarantine or rename the detected program or file, or ask you for a desired action.

Knowledge Base

Find the latest advice in our Community Knowledge Base.

About the product

See the manual for your F-Secure product on the Help Center.

Contact Support

Chat with or call an expert for help.

Submit a sample

Submit a file or URL for further analysis.

Technical Details


The worm is a Windows PE executable file 80384 bytes long.

Installation to system

When run, the worm installs itself to system. It copies its file to %SYSTEM% folder under a pseudo-random name. To ensure the worm is started next time the system is started a registry key is created:

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]  "" = "%SYSTEM%\.exe"   

where <pseudo_random_str> is a ASCII string that is generated by the worm depending on the local disk characteristics and %SYSTEM% is Windows System folder name.

It then drops a BHO (Browser Helper Object) DLL and registers it. The name of the BHO is also pseudo-random. The BHO is a spying trojan which collects various information and is usually activated automatically by Windows when Internet Explorer is started.

A third file is dropped. It is a ZIP archive that contains the main worm. The ZIP has on of the following names:

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"" = "%SYSTEM%\.exe"
 

and contains the worm's body under one of the following names:

screensaver.scr  song.wav.scr  music.mp3.scr  video.avi.scr  photo.jpg.scr  girls.jpg.scr  pic.jpg.scr  message.txt.scr  image.jpg.scr  news.doc.scr  details.doc.scr  resume.doc.scr  love.jpg.scr  readme.txt.scr   
Spreading in email

Eyeveg.f has mass-mailing capabilities. It will collect email addresses from files with extensions:

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"" = "%SYSTEM%\.exe"
 

The worm avoids sending messages to emails which contain the following strings:

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"" = "%SYSTEM%\.exe"
 
Payload

The worm has functionality that allows it to:

  • 1. Upload files to 'www.melaniecarroll.biz' server
  • 2. Download files from 'www.melaniecarroll.biz' server
  • 3. Find files
  • 4. Copy files
  • 5. Start files
  • 6. Delete files
  • 7. List files
  • 8. Get system information