Yanz.A

The worm's file is a PE executable file about 102 kilobytes long. The file is not packed.

Installation to system

When the worm's file is run for the first time, it shows a fake messagebox:

HATA KERNEL HATASI

Then the worm copies itself to Windows System directory as LSASSS.EXE and as YANZI.EXE and creates a startup key for the first file in System Registry:

[HKLM\Software\Microsoft\Windows\CurrentVersion\Run] "Microsoft Kernel" = "%WinSysDir%\lsasss.exe"

where %WinSysDir% represents Windows System folder, for example 'c:\windows\system32' for default Windows XP installation.

Also the worm creates a ZIP archive named YanZi.zip with the worm's file named 'Sun YanZi.pif' in Windows folder. The worm uses 'store' method to create a ZIP archive meaning that the worm's file inside the archive is not compressed.

The worm creates a short HTML file named 'sun_yanzi.htm' in the current directory and writes 'Sun-Yanzi' text string there.

Additionally the worm creates 2 base64-encoded files in Windows System folder:

• sun.sys
• sun_yanzi.sys

The first file is a base64-encoded copy of the worm, the second one is a base64-encoded copy of the worm in a ZIP archive. These files are used during spreading of the worm in emails.

The worm creates a mutex with the name 'Sun YanZi - forever'.

Spreading in emails

Before spreading the worm reads user's Address Book and scans a hard drive to harvert victims' email addresses. The worm scans files with the following extensions:

• dbx
• adb
• asp
• jsp
• rtf
• doc
• xml
• txt
• htm
• html

The worm ignores email addresses if they contain any of the following substrings:

• @google
• @norman
• @sophos
• @symantec
• @kaspersky
• @pandasoftware
• @microsoft

The worm sends emails with different subjects, body texts and attachment names. The subject of an infected email is selected from the following variants:

• SuN YanZi
• Sun-YanZi
• Guvenlik
• Sun-YanZi Mp3
• Free MP3
• Love and SuN YanZi
• Forever Sun Yanzi

The body text of an infected email is selected from the following variants:

• I don't want anything. I want to see Sun YanZi
• My Favourite is Sun YanZi.
• I want to meet Sun YanZi. I am loving Sun-YanZi Magic.
• You must to listen Sun-Yanzi. I am enjoying to listen Sun YanZi.

The attachment is either a ZIP archive with the worm's executable file or the worm's executable file itself. The name of an infected attachment is selected from the following variants:

• SunYanzi
• Sun_Yanzi
• Sun_Yanzi_Mp3
• Love_Sun
• Stephan_Yanzi

The extension of an infected attachment can be:

• .cmd
• .pif
• .scr

Spreading to shared folders

The worm scans all available hard drives and ram disks. If it finds a folder with the name that contains 'shar' substring, it copies itself there with the following names:

• Sun YanZi.avi.exe
• Sun YanZi.mpg.exe
• Sun YanZi.mpeg.exe
• Sun YanZi - Shen Qi.exe
• Sun YanZi - I am not sad.mp3.exe
• Sun YanZi - Leave me alone.mp3.exe
• Sun YanZi - forever.mp3.exe
• Stephan YanZi.Mp3.exe
• Sun-YanZi.mp3.exe

This way the worm can spread to shared folders of P2P (peer-to-peer) clients and to local network.

Backdoor

The worm has a simple backdoor that listens on TCP port 67. It allows to download and run executable files from Internet.

Payload

During its installation cycle the worm kills the following processes:

• REGEDIT.EXE
• MSCONFIG.EXE