Virus:​W32/Gnil.A

Threat description

Details

CATEGORYMalware
TYPEVirus
DATE DISCOVERED2007-03-08 00:00:00.0

Summary

Gnil.A has the ability to infect remote computers over a local network and attempts to download and install other malware to the system.



Removal

Automatic action

Depending on the settings of your F-Secure security product, it will either automatically delete, quarantine or rename the suspect file, or ask you for a desired action.

More scanning & removal options

More information on the scanning and removal options available in your F-Secure product can be found in the Help Center.

You may also refer to the Knowledge Base on the F-Secure Community site for more information.

Contact Support

F-Secure customers can request support online via the Request support or the Chat forms on our Home - Global site.

Technical Details

Gnil.A may arrive in the system as an executable with an icon that depicts an alien.

Sample screenshot:

Once the execution of Gnil.A has been initiated, it will drop the following files into the Windows System directory:

  • xrtnyo.exe - Loader of the .dll component
  • xrtnyo.dll - Contains most of the payload

It will delete the executed copy of itself with the help of a batch file created in the temporary folder:

  • ~Lying!.bAt

Gnil.A injects its .DLL component to the following processes:

  • explorer.exe
  • services.exe
  • winlogon.exe

It terminates the following processes related to Viking and Fujacks variants:

  • c0nime.exe
  • iexpl0re.exe
  • FuckJacks.exe
  • Logo1_.exe
  • Logo_1.exe
  • nvscv32.exe
  • Rundl132.exe
  • spoclsv.exe
  • svch0st.exe

Note: String comparison is case sensitive.

It infects binary files of the following extension:

  • .exe
  • .scr

Moreover Gnil.A also infects script files with the following extension:

  • .asp
  • .css
  • .htm
  • .html
  • .js

It avoids infecting folders with the following strings:

  • ComPlus Applications
  • Common Files
  • Delphi
  • Internet Explorer
  • Messenger
  • Microsoft Frontpage
  • Movie Maker
  • NetMeeting
  • Online Services
  • Outlook Express
  • RECYCLER
  • System Volume Information
  • System32
  • WINNT
  • WinRAR
  • Windows
  • Windows Media Player
  • Windows NT

Note: String comparison is case sensitive. This is why most system files are still infected.

Gnil.A will append a code at the end of the script file to point to a malicious website:

  • https://www.lovesa.info/l[BLOCKED].gif

Note: As of this writing the site is no longer available

Gnil.A may also use Internet Explorer to download from the said site. It gets the location of Internet Explorer by querying the following registry entry:

  • HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\IEXPLORE.EXE

Or it may use the following hard coded path:

  • C:\Program Files\Internet Explorer\IEXPLORE.EXE

Aside from infecting binary and script files as a way to propagate, it can also spread via network shares using a combination of the following strings as username and passwords:

  • 000000
  • 00000000
  • 111111
  • 11111111
  • 121212
  • 123123
  • 123321
  • 12345
  • 123456
  • 1234567
  • 12345678
  • 123456789
  • 1234qwer
  • 123abc
  • 123asd
  • 123qwe
  • 5021314
  • 5201314
  • 520520
  • 54321
  • 654321
  • 88888
  • 88888888
  • 999999
  • Admin
  • Administrator
  • Password
  • abc123
  • abcd123
  • admin
  • admin123
  • administrator
  • asdf123
  • byebye
  • china
  • computer
  • database
  • enable
  • foobar
  • fuckyou
  • ghost
  • godblessyou
  • goodbye
  • guest
  • guest123
  • guest321
  • hao123
  • happy
  • ihavenopass
  • iloveyou
  • internet
  • japan
  • kaonima
  • login
  • loveyou
  • mylove
  • mypass
  • mypass123
  • oracle
  • passwd
  • password
  • server
  • super
  • sybase
  • temp123
  • test123
  • users
  • wangba
  • window
  • windows
  • windows2000
  • windows2003
  • windowsxp

Description Created: 2007-03-15 00:52:12.0

Description Last Modified: 2007-03-15 13:57:34.0

Submit a Sample

Suspect a file or URL was wrongly detected?
Send it to our Labs for further analysis

Submit a Sample

Give And Get Advice

Give advice. Get advice. Share the knowledge on our free discussion forum.

More Info