Funny

Threat description

Details

CATEGORYMalware
TYPEWorm

Summary

Funny worm spreads in a similar way as LoveLetter. All three known variants of this worm drop, run and delete a binary file Startx.exe that is a password stealing trojan detected by F-Secure Anti-Virus as 'Trojan.PSW.Hooker.24.e'. This trojan is run if the virus found a UBS banking software installed on the victim's machine. Otherwise it replicates as a worm.

Removal

Automatic action

Depending on the settings of your F-Secure security product, it will either automatically delete, quarantine or rename the suspect file, or ask you for a desired action.

More scanning & removal options

More information on the scanning and removal options available in your F-Secure product can be found in the Help Center.

You may also refer to the Knowledge Base on the F-Secure Community site for more information.

Contact Support

F-Secure customers can request support online via the Request support or the Chat forms on our Home - Global site.

Technical Details


Variant:Funny.A

This variant sends e-mail to all recipients in Outlook address book with:

Subject: Funny story



 Attachment: FUNNY_STORY.HTM.vbs

In addition, it tries to connect to a web location.


Variant:Funny.B

This variant is similar with Funny.A, but it sends messages with the following:

Subject: When did you die?



 Attachment: LIFE_ASSURANCE.HTM.vbs

Variant:Funny.C

Funny.C spreads in messages with:

Subject: Rechnungsabschrift



 Attachment: RECHNUNGSABSCHRIFT.DOC.vbs

This variant does not try to connect to the web. It creates a text file RECHNUNGSABSCHRIFT.DOC and open it with Write.exe. The text file contains the following information:

INVOICE

 Date:
September 18, 2000

 From:
Katrin Heinze



19, chemin des Aulx



CH-1228



Plan-les-Ouates,



Geneva



Switzerland

 To:
 Myron Schmidt"



Ch. des Boveresses 151



CH-1066 Epalingess/Lausanne



Switzerland

 Item

Description

 Item

Description


 Cost

1


August Voice Mail Charges


CHF
35.00

 1


Internet - Reserve Domain Name (2 years)
 CHF
250.00

 1


Internet - Set Up Fee




CHF
110.00

 1


Internet - Creation Fee



CHF
250.00

 1


Internet - Submit to 540 Search Engines

CHF
50.00

 1


Internet 6 Months of Hosting
 CHF
200.00

 Total



 CHF 895.00

Submit a Sample

Suspect a file or URL was wrongly detected? Send it to our Labs for further analysis

Submit a Sample

Give And Get Advice

Give advice. Get advice. Share the knowledge on our free discussion forum.

More Info