Worm/Mytob.HD - Worm

See also

Summary

Full description

Statistics

Virus:	Worm/Mytob.HD
Date discovered:	21/06/2005
Type:	Worm
In the wild:	Yes
Reported Infections:	Low
Distribution Potential:	Medium
Damage Potential:	Medium
Static file:	Yes
File size:	36.352 Bytes
MD5 checksum:	e63fb0b088390D874acc7f75daca4cc8
VDF version:	6.31.00.90 - Tue, 21 Jun 2005 16:36 (GMT+1) - Tue, 21 Jun 2005 16:36 (GMT+1)
IVDF version:	6.31.00.90 - Tue, 21 Jun 2005 16:36 (GMT+1) - Tue, 21 Jun 2005 16:36 (GMT+1)

General Method of propagation:
   • Email

Aliases:
   • Mcafee: W32/Mytob.gen@MM
   • Kaspersky: Net-Worm.Win32.Mytob.bi
   • Grisoft: I-Worm/Mytob.PX
   • VirusBuster: I-Worm.Mytob.HP
   • Eset: Win32/Mytob.GB
   • Bitdefender: Win32.Worm.Mytob.DE

Platforms / OS:
   • Windows 95
   • Windows 98
   • Windows 98 SE
   • Windows NT
   • Windows ME
   • Windows 2000
   • Windows XP
   • Windows 2003

Side effects:
   • Blocks access to security websites
   • Disable security applications
   • Uses its own Email engine
   • Registry modification
   • Third party control

Files It copies itself to the following location:
• %SYSDIR%\smoc.exe

Registry The following registry keys are added in order to run the processes after reboot:

– [HKLM\Software\Microsoft\Windows\CurrentVersion\Run]
   • WINDOWS SYSTEM="smoc.exe"

– [HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices]
   • WINDOWS SYSTEM="smoc.exe"

The following registry key is changed:

Deactivate Windows XP Firewall:
– [HKLM\SYSTEM\ControlSet001\Services\SharedAccess]
   Old value:
   • "Start"=dword:00000002
   New value:
   • Start=dword:00000004

Email It contains an integrated SMTP engine in order to send emails. A direct connection with the destination server will be established. The characteristics are described in the following:

From:
The sender of the email is one of the following:
   • support
   • administrator
   • mail
   • service
   • admin
   • info
   • register
   • webmaster

To:
– Email addresses found in specific files on the system.
– Email addresses gathered from WAB (Windows Address Book)
– Generated addresses

Subject:
One of the following:
   • *DETECTED* Online User Violation
   • Email Account Suspension
   • Important Notification
   • Members Support
   • Notice of account limitation
   • Warning Message: Your services near to be closed.
   • You have successfully updated your password
   • Your Account is Suspended
   • You have successfully updated your password
   • Your Account is Suspended
   • Your Account is Suspended For Security Reasons
   • Your new account password is approved
   • Your password has been successfully updated
   • Your password has been updated
   • %random character string%

Body:
– Contains HTML code.

The body of the email is one of the lines:
   • Dear %sender's domain% Member,We have temporarily suspended your email account %receiver's email address% This might be due to either of the following reasons: 1. A recent change in your personal information (i.e. change of address). 2. Submiting invalid information during the initial sign up process. 3. An innability to accurately verify your selected option of subscription due to an internal error within our processors.See the details to reactivate your %sender's domain% account. Sincerely, The %sender's domain% Support Team +++ Attachment: No Virus (Clean) +++ %sender's domain%Antivirus - www.%sender's domain%
   • Dear %sender's domain% Member, Your e-mail account was used to send a huge amount of unsolicited spam messages during the recent week. If you could please take 5-10 minutes out of your online experience and confirm the attached document so you will not run into any future problems with the online service. If you choose to ignore our request, you leave us no choice but to cancel your membership. Virtually yours, The %sender's domain% Support Team +++ Attachment: No Virus found +++ %sender's domain% Antivirus - www.%sender's domain%
   • Dear user %email account's user name%, You have successfully updated the password of your .%sender's domain% account.If you did not authorize this change or if you need assistance with your account, please contact %sender's domain% customer service at: %sender's email address%. Thank you for using %sender's domain%! The %sender's domain% Support Team. +++ Attachment: No Virus (Clean) +++ %sender's domain% Antivirus - www.%sender's domain%
   • Dear user %email account's user name%, It has come to our attention that your %sender's domain% User Profile ( x ) records are out of date. For further details see the attached document. Thank you for using %sender's domain%! The %sender's domain% Support Team. +++ Attachment: No Virus (Clean) +++ %sender's domain% Antivirus - www.%sender's domain%

Attachment:
The filename of the attachment is one of the following:
   • readme
   • document
   • account-report
   • account-info
   • email-details
   • account-details
   • important-details
   • accepted-password
   • account-password
   • approved-password
   • password
   • new-password
   • email-password
   • updated-password
   • %random character string%

    The file extension is one of the following:
   • bat
   • cmd
   • exe
   • scr
   • pif
   • zip

The attachment is a copy of the malware itself.

The email looks like the following:

Mailing Search addresses:
It searches the following files for email addresses:
   • wab; adb; tbb; dbx; php; sht; htm; html; xml; cgi; jsp; tmp

Address generation for TO field:
To generate addresses it uses the following strings:
   • john; josh; alex; michael; james; mike; kevin; david; george; sam;
      andrew; jose; leo; maria; jim; brian; serg; mary; ray; tom; peter;
      robert; bob; jane; joe; dan; dave; matt; steve; smith; stan; bill;
      bob; jack; fred; ted; paul; brent; sales; anna; brenda; claudia;
      debby; helen; jerry; jimmy; julie; linda; michael; frank; adam; sandra

Avoid addresses:
It does not send emails to addresses containing one of the following strings:
   • avp; syma; icrosof; msn.; hotmail; panda; sopho; borlan; inpris;
      example; mydomai; nodomai; ruslis; .gov; gov.; .mil; foo.; berkeley;
      unix; math; bsd; mit.e; gnu; fsf.; ibm.com; google; kernel; linux;
      fido; usenet; iana; ietf; rfc-ed; sendmail; arin.; ripe.; isi.e;
      isc.o; secur; acketst; pgp; tanford.e; utgers.ed; mozilla; be_loyal:;
      root; info; samples; postmaster; webmaster; noone; nobody; nothing;
      anyone; someone; your; you; me; bugs; rating; site; contact; soft; no;
      somebody; privacy; service; help; not; submit; feste; ca; gold-certs;
      the.bat; page; admin; icrosoft; support; ntivi; unix; bsd; linux;
      listserv; certific; google; accoun; spm; fcnz; www; secur; abuse

Prepend MX strings:
In order to get the IP address of the mail server it has the ability to prepend the following strings to the domain name:
   • gate.
   • ns.
   • relay.
   • mail1.
   • mxs.
   • mx1.
   • smtp.
   • mail.
   • mx.

IRC To deliver system information and to provide remote control it connects to the following IRC Server:

Server: irc.bihsecurity.com
Port: 6667
Channel: #supernew
Nickname: [etc]%random character string%
Password: test;logon;master;lamer

– This malware has the ability to collect and send information such as:
    • CPU speed
    • Current user
    • Free disk space
    • Free memory
    • Malware uptime
    • Information about the network
    • Size of memory
    • Username
    • Information about the Windows operating system

– Furthermore it has the ability to perform actions such as:
    • connect to IRC server
    • disconnect from IRC server
    • Download file
    • Join IRC channel
    • Leave IRC channel
    • Send emails
    • Updates itself

Hosts The host file is modified as explained:

The modified host file will look like this:

Process termination List of processes that are terminated:
   • ACKWIN32.EXE; ADAWARE.EXE; ADVXDWIN.EXE; AGENTSVR.EXE; AGENTW.EXE;
      ALERTSVC.EXE; ALEVIR.EXE; ALOGSERV.EXE; AMON9X.EXE; ANTI-TROJAN.EXE;
      ANTIVIRUS.EXE; ANTS.EXE; APIMONITOR.EXE; APLICA32.EXE; APVXDWIN.EXE;
      ARR.EXE; ATCON.EXE; ATGUARD.EXE; ATRO55EN.EXE; ATUPDATER.EXE;
      ATUPDATER.EXE; ATWATCH.EXE; AU.EXE; AUPDATE.EXE; AUPDATE.EXE;
      AUTODOWN.EXE; AUTODOWN.EXE; AUTOTRACE.EXE; AUTOTRACE.EXE;
      AUTOUPDATE.EXE; AUTOUPDATE.EXE; AVCONSOL.EXE; AVE32.EXE; AVGCC32.EXE;
      AVGCTRL.EXE; AVGNT.EXE; AVGSERV.EXE; AVGSERV9.EXE; AVGUARD.EXE;
      AVGW.EXE; AVKPOP.EXE; AVKSERV.EXE; AVKSERVICE.EXE; AVKWCTl9.EXE;
      AVLTMAIN.EXE; AVNT.EXE; AVP.EXE; AVP32.EXE; AVPCC.EXE; AVPDOS32.EXE;
      AVPM.EXE; AVPTC32.EXE; AVPUPD.EXE; AVPUPD.EXE; AVSCHED32.EXE;
      AVSYNMGR.EXE; AVWINNT.EXE; AVWUPD.EXE; AVWUPD32.EXE; AVWUPD32.EXE;
      AVWUPSRV.EXE; AVXMONITOR9X.EXE; AVXMONITORNT.EXE; AVXQUAR.EXE;
      AVXQUAR.EXE; BACKWEB.EXE; BARGAINS.EXE; BD_PROFESSIONAL.EXE;
      BEAGLE.EXE; BELT.EXE; BIDEF.EXE; BIDSERVER.EXE; BIPCP.EXE;
      BIPCPEVALSETUP.EXE; BISP.EXE; BLACKD.EXE; BLACKICE.EXE; BLSS.EXE;
      BOOTCONF.EXE; BOOTWARN.EXE; BORG2.EXE; BPC.EXE; BRASIL.EXE; BS120.EXE;
      BUNDLE.EXE; BVT.EXE; CCAPP.EXE; CCEVTMGR.EXE; CCPXYSVC.EXE; CDP.EXE;
      CFD.EXE; CFGWIZ.EXE; CFIADMIN.EXE; CFIAUDIT.EXE; CFIAUDIT.EXE;
      CFINET.EXE; CFINET32.EXE; CLEAN.EXE; CLEANER.EXE; CLEANER3.EXE;
      CLEANPC.EXE; CLICK.EXE; CMD32.EXE; CMESYS.EXE; CMGRDIAN.EXE;
      CMON016.EXE; CONNECTIONMONITOR.EXE; CPD.EXE; CPF9X206.EXE;
      CPFNT206.EXE; CTRL.EXE; CV.EXE; CWNB181.EXE; CWNTDWMO.EXE;
      CLAW95CF.EXE; DATEMANAGER.EXE; DCOMX.EXE; DEFALERT.EXE;
      DEFSCANGUI.EXE; DEFWATCH.EXE; DEPUTY.EXE; DIVX.EXE; DLLCACHE.EXE;
      DLLREG.EXE; DOORS.EXE; DPF.EXE; DPFSETUP.EXE; DPPS2.EXE; DRWATSON.EXE;
      DRWEB32.EXE; DRWEBUPW.EXE; DSSAGENT.EXE; DVP95.EXE; DVP95_0.EXE;
      ECENGINE.EXE; EFPEADM.EXE; EMSW.EXE; ENT.EXE; ESAFE.EXE; ESCANHNT.EXE;
      ESCANV95.EXE; ESPWATCH.EXE; ETHEREAL.EXE; ETRUSTCIPE.EXE; EVPN.EXE;
      EXANTIVIRUS-CNET.EXE; EXE.AVXW.EXE; EXPERT.EXE; EXPLORE.EXE;
      F-PROT.EXE; F-PROT95.EXE; F-STOPW.EXE; FAMEH32.EXE; FAST.EXE;
      FCH32.EXE; FIH32.EXE; FINDVIRU.EXE; FIREWALL.EXE; FNRB32.EXE;
      FP-WIN.EXE; FP-WIN_TRIAL.EXE; FPROT.EXE; FRW.EXE; FSAA.EXE; FSAV.EXE;
      FSAV32.EXE; FSAV530STBYB.EXE; FSAV530WTBYB.EXE; FSAV95.EXE;
      FSGK32.EXE; FSM32.EXE; FSMA32.EXE; FSMB32.EXE; GATOR.EXE; GBMENU.EXE;
      GBPOLL.EXE; GENERICS.EXE; GMT.EXE; GUARD.EXE; GUARDDOG.EXE;
      HACKTRACERSETUP.EXE; HBINST.EXE; HBSRV.EXE; HOTACTIO.EXE;
      HOTPATCH.EXE; HTLOG.EXE; HTPATCH.EXE; HWPE.EXE; HXDL.EXE; HXIUL.EXE;
      IAMAPP.EXE; IAMSERV.EXE; IAMSTATS.EXE; IBMASN.EXE; IBMAVSP.EXE;
      ICLOADNT.EXE; ICMON.EXE; ICSUPP95.EXE; ICSUPPNT.EXE; IDLE.EXE;
      IEDLL.EXE; IEDRIVER.EXE; IEXPLORER.EXE; IFACE.EXE; IFW2000.EXE;
      INETLNFO.EXE; INFUS.EXE; INFWIN.EXE; INIT.EXE; INTDEL.EXE; INTREN.EXE;
      IOMON98.EXE; ISTSVC.EXE; JAMMER.EXE; JDBGMRG.EXE; JEDI.EXE;
      KAVLITE40ENG.EXE; KAVPERS40ENG.EXE; KAVPF.EXE; KAZZA.EXE;
      KEENVALUE.EXE; KERIO-PF-213-EN-WIN.EXE; KERIO-WRL-421-EN-WIN.EXE;
      KERIO-WRP-421-EN-WIN.EXE; KERNEL32.EXE; KILLPROCESSSETUP161.EXE;
      LAUNCHER.EXE; LDNETMON.EXE; LDPRO.EXE; LDPROMENU.EXE; LDSCAN.EXE;
      LNETINFO.EXE; LOADER.EXE; LOCALNET.EXE; LOCKDOWN.EXE;
      LOCKDOWN2000.EXE; LOOKOUT.EXE; LORDPE.EXE; LSETUP.EXE; LUALL.EXE;
      LUALL.EXE; LUAU.EXE; LUCOMSERVER.EXE; LUINIT.EXE; LUSPT.EXE;
      MAPISVC32.EXE; MCAGENT.EXE; MCMNHDLR.EXE; MCSHIELD.EXE; MCTOOL.EXE;
      MCUPDATE.EXE; MCUPDATE.EXE; MCVSRTE.EXE; MCVSSHLD.EXE; MD.EXE;
      MFIN32.EXE; MFW2EN.EXE; MFWENG3.02D30.EXE; MGAVRTCL.EXE; MGAVRTE.EXE;
      MGHTML.EXE; MGUI.EXE; MINILOG.EXE; MMOD.EXE; MONITOR.EXE; MOOLIVE.EXE;
      MOSTAT.EXE; MPFAGENT.EXE; MPFSERVICE.EXE; MPFTRAY.EXE; MRFLUX.EXE;
      MSAPP.EXE; MSBB.EXE; MSBLAST.EXE; MSCACHE.EXE; MSCCN32.EXE;
      MSCMAN.EXE; MSCONFIG.EXE; MSDM.EXE; MSDOS.EXE; MSIEXEC16.EXE;
      MSINFO32.EXE; MSLAUGH.EXE; MSMGT.EXE; MSMSGRI32.EXE; MSSMMC32.EXE;
      MSSYS.EXE; MSVXD.EXE; MU0311AD.EXE; MWATCH.EXE; N32SCANW.EXE; NAV.EXE;
      AUTO-PROTECT.NAV80TRY.EXE; NAVAP.NAVAPSVC.EXE; NAVAPSVC.EXE;
      NAVAPW32.EXE; NAVDX.EXE; NAVLU32.EXE; NAVNT.EXE; NAVSTUB.EXE;
      NAVW32.EXE; NAVWNT.EXE; NC2000.EXE; NCINST4.EXE; NDD32.EXE;
      NEOMONITOR.EXE; NEOWATCHLOG.EXE; NETARMOR.EXE; NETD32.EXE;
      NETINFO.EXE; NETMON.EXE; NETSCANPRO.EXE; NETSPYHUNTER-1.2.EXE;
      NETSTAT.EXE; NETUTILS.EXE; NISSERV.EXE; NISUM.EXE; NMAIN.EXE;
      NOD32.EXE; NORMIST.EXE; NORTON_INTERNET_SECU_3.0_407.EXE;
      NOTSTART.EXE; NPF40_TW_98_NT_ME_2K.EXE; NPFMESSENGER.EXE;
      NPROTECT.EXE; NPSCHECK.EXE; NPSSVC.EXE; NSCHED32.EXE; NSSYS32.EXE;
      NSTASK32.EXE; NSUPDATE.EXE; NT.EXE; NTRTSCAN.EXE; NTVDM.EXE;
      NTXconfig.EXE; NUI.EXE; NUPGRADE.EXE; NUPGRADE.EXE; NVARCH16.EXE;
      NVC95.EXE; NVSVC32.EXE; NWINST4.EXE; NWSERVICE.EXE; NWTOOL16.EXE;
      OLLYDBG.EXE; ONSRVR.EXE; OPTIMIZE.EXE; OSTRONET.EXE; OTFIX.EXE;
      OUTPOST.EXE; OUTPOST.EXE; OUTPOSTINSTALL.EXE; OUTPOSTPROINSTALL.EXE;
      PADMIN.EXE; PANIXK.EXE; PATCH.EXE; PAVCL.EXE; PAVPROXY.EXE;
      PAVSCHED.EXE; PAVW.EXE; PCFWALLICON.EXE; PCIP10117_0.EXE; PCSCAN.EXE;
      PDSETUP.EXE; PERISCOPE.EXE; PERSFW.EXE; PERSWF.EXE; PF2.EXE;
      PFWADMIN.EXE; PGMONITR.EXE; PINGSCAN.EXE; PLATIN.EXE; POP3TRAP.EXE;
      POPROXY.EXE; POPSCAN.EXE; PORTDETECTIVE.EXE; PORTMONITOR.EXE;
      POWERSCAN.EXE; PPINUPDT.EXE; PPTBC.EXE; PPVSTOP.EXE; PRIZESURFER.EXE;
      PRMT.EXE; PRMVR.EXE; PROCDUMP.EXE; PROCESSMONITOR.EXE;
      PROCEXPLORERV1.0.EXE; PROGRAMAUDITOR.EXE; PROPORT.EXE; PROTECTX.EXE;
      PSPF.EXE; PURGE.EXE; QCONSOLE.EXE; QSERVER.EXE; RAPAPP.EXE; RAV7.EXE;
      RAV7WIN.EXE; RAV8WIN32ENG.EXE; RAY.EXE; RB32.EXE; RCSYNC.EXE;
      REALMON.EXE; REGED.EXE; REGEDIT.EXE; REGEDT32.EXE; RESCUE.EXE;
      RESCUE32.EXE; RRGUARD.EXE; RSHELL.EXE; RTVSCAN.EXE; RTVSCN95.EXE;
      RULAUNCH.EXE; RUN32DLL.EXE; RUNDLL.EXE; RUNDLL16.EXE; RUXDLL32.EXE;
      SAFEWEB.EXE; SAHAGENT.EXE; SAVE.EXE; SAVENOW.EXE; SBSERV.EXE; SC.EXE;
      SCAM32.EXE; SCAN32.EXE; SCAN95.EXE; SCANPM.EXE; SCRSCAN.EXE;
      SETUPVAMEEVAL.EXE; SETUP_FLOWPROTECTOR_US.EXE; SFC.EXE; SGSSFW32.EXE;
      SH.EXE; SHELLSPYINSTALL.EXE; SHN.EXE; SHOWBEHIND.EXE; SMC.EXE;
      SMS.EXE; SMSS32.EXE; SOAP.EXE; SOFI.EXE; SPERM.EXE; SPF.EXE;
      SPHINX.EXE; SPOLER.EXE; SPOOLCV.EXE; SPOOLSV32.EXE; SPYXX.EXE;
      SREXE.EXE; SRNG.EXE; SS3EDIT.EXE; SSGRATE.EXE; SSG_4104.EXE; ST2.EXE;
      START.EXE; STCLOADER.EXE; SUPFTRL.EXE; SUPPORT.EXE; SUPPORTER5.EXE;
      SVC.EXE; SVCHOSTC.EXE; SVCHOSTS.EXE; SVSHOST.EXE; SWEEP95.EXE;
      SWEEPNET.SWEEPSRV.SYS.SWNETSUP.EXE; SYMPROXYSVC.EXE; SYMTRAY.EXE;
      SYSEDIT.EXE; SYSTEM.EXE; SYSTEM32.EXE; SYSUPD.EXE; TASKMG.EXE;
      TASKMO.EXE; TASKMON.EXE; TAUMON.EXE; TBSCAN.EXE; TC.EXE; TCA.EXE;
      TCM.EXE; TDS-3.EXE; TDS2-NT.EXE; TEEKIDS.EXE; TFAK.EXE; TFAK5.EXE;
      TGBOB.EXE; TITANIN.EXE; TITANINXP.EXE; TRACERT.EXE; TRICKLER.EXE;
      TRJSCAN.EXE; TRJSETUP.EXE; TROJANTRAP3.EXE; TSADBOT.EXE; TVMD.EXE;
      TVTMD.EXE; UNDOBOOT.EXE; UPDAT.EXE; UPDATE.EXE; UPDATE.EXE;
      UPGRAD.EXE; UTPOST.EXE; VBCMSERV.EXE; VBCONS.EXE; VBUST.EXE;
      VBWIN9X.EXE; VBWINNTW.EXE; VCSETUP.EXE; VET32.EXE; VET95.EXE;
      VETTRAY.EXE; VFSETUP.EXE; VIR-HELP.EXE; VIRUSMDPERSONALFIREWALL.EXE;
      VNLAN300.EXE; VNPC3000.EXE; VPC32.EXE; VPC42.EXE; VPFW30S.EXE;
      VPTRAY.EXE; VSCAN40.EXE; VSCENU6.02D30.EXE; VSCHED.EXE; VSECOMR.EXE;
      VSHWIN32.EXE; VSISETUP.EXE; VSMAIN.EXE; VSMON.EXE; VSSTAT.EXE;
      VSWIN9XE.EXE; VSWINNTSE.EXE; VSWINPERSE.EXE; W32DSM89.EXE; W9X.EXE;
      WATCHDOG.EXE; WEBDAV.EXE; WEBSCANX.EXE; WEBTRAP.EXE; WFINDV32.EXE;
      WHOSWATCHINGME.EXE; WIMMUN32.EXE; WIN-BUGSFIX.EXE; WIN32.EXE;
      WIN32US.EXE; WINACTIVE.EXE; WINDOW.EXE; WINDOWS.EXE; WININETD.EXE;
      WININIT.EXE; WININITX.EXE; WINLOGIN.EXE; WINMAIN.EXE; WINNET.EXE;
      WINPPR32.EXE; WINRECON.EXE; WINSERVN.EXE; WINSSK32.EXE; WINSTART.EXE;
      WINSTART001.EXE; WINTSK32.EXE; WINUPDATE.EXE; WKUFIND.EXE; WNAD.EXE;
      WNT.EXE; WRADMIN.EXE; WRCTRL.EXE; WSBGATE.EXE; WUPDATER.EXE;
      WUPDT.EXE; WYVERNWORKSFIREWALL.EXE; XPF202EN.EXE; ZAPRO.EXE;
      ZAPSETUP3001.EXE; ZATUTOR.EXE; ZONALM2601.EXE; ZONEALARM.EXE;
      _AVP32.EXE; _AVPCC.EXE; _AVPM.EXE; CMD.EXE; TASKMGR.EXE; NEC.EXE

Miscellaneous Mutex:
It creates the following Mutex:
• H-E-L-L-B-O-T-P-O-L-Y-M-O-R-P-H

File details Programming language:
The malware program was written in MS Visual C++.

Runtime packer:
In order to aggravate detection and reduce size of the file it is packed with the following runtime packer:
• PECompact

See a brief description here.

Description inserted by Ana Maria Niculescu on Wed, 17 Oct 2007 15:33 (GMT+1)
Description updated by Andrei Gherman on Tue, 23 Oct 2007 11:29 (GMT+1)

» About Malware
» About Phishing
» Viruses In the Wild

« back