Filesystem
When first run, the worm copies itself to %SYSDIR%\osalogbe.exe.
Note: %SYSDIR% refers to the System directory. The default path for the respective operating systems is as follows:
- Windows 95/98/Me - C:\Windows\System
- Windows NT/2000 - C:\Winnt\System32
- Windows XP - C:\Windows\System32
It harvests e-mail addresses on all available hard drives, in all files having one of the following extensions:
wab
adb
tbb
dbx
asp
php
aspx
html
sht
htm
Registry
Adds the value:
"Osalogbe"="%SYSDIR%\osalogbe.exe"
To the key:
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
To make sure it's run at Windows startup.
Creates the key:
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\osunimale]
as an infection marker.
Queries the key:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Account Manager\Accounts]
in an attempt to locate a mail server.
Queries the key:
[HKEY_CURRENT_USER\Software\Microsoft\WAB\WAB4\Wab File Name]
to try to find the user's address book.
Mail routine
The worm sends itself as an attachment to an e-mail with the following characteristics:
The worm may spoof the from address.
Attached is a file named %name%.%ext% or %name%.zip containing the file %name%.%ext%. Where %name% is one the following:
body
message
test
data
file
text
doc
readme
document
and %ext% is one of the following extensions:
bat
cmd
exe
scr
The worm avoids sending itself to e-mail addresses having one of the following string in the name field:
admin
page
the.bat
gold-certs
feste
submit
not
help
service
privacy
somebody
soft
contact
site
rating
bugs
you
your
someone
anyone
nothing
nobody
noone
webmaster
postmaster
samples
info
root
or containing any of the following substrings in the domain field:
mozilla
utgers.ed
tanford.e
pgp
acketst
secur
isc.o
isi.e
ripe.
arin.
sendmail
rfc-ed
ietf
iana
usenet
fido
kernel
ibm.com
fsf.
gnu
mit.e
math
berkeley
foo.
.mil
gov.
.gov
ruslis
nodomai
mydomai
example
inpris
borlan
sopho
panda
icrosof
syma
avp
accoun
google
certific
listserv
linux
bsd
unix
ntivi
support
icrosoft
Other payloads
Prepends the following strings to the domain name, in an attempt to locate a mail server:
gate.
ns.
relay.
mail1.
mxs.
mx1.
smtp.
mail.
mx.
| 