On startup it displays a phony Winzip error message box:
It then modifies the registry, creating several files on the system, some are used as templates and others are copies of the worm itself.
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"WinStart"="%system%\Connection Wizard\\Status\\services.exe"
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"_WinStart"="%system%\Connection Wizard\\Status\\services.exe"
The worm creates copies of itself in the following directories, also created by the worm:
Duplicate copies of the worm:
%system%\Connection Wizard\Status\csrss.exe
%system%\Connection Wizard\Status\services.exe
%system%\Connection Wizard\Status\smss.exe
The worm also dumps temporary files and templates:
%system%\Connection Wizard\Status\fastso.ber
%system%\adcmmmmq.hjg
%system%\langeinf.lin
%system%\nonrunso.ber
%system%\seppelmx.smx
%system%\xcvfpokd.tqa
Here it stores the e-mail addresses it gathers from the victims computer:
%system%\Connection Wizard\Status\voner1.von
%system%\Connection Wizard\Status\voner2.von
%system%\Connection Wizard\Status\voner3.von
These files are base64 encoded templates of the worm:
%system%\Connection Wizard\Status\packed1.sbr
%system%\Connection Wizard\Status\packed2.sbr
%system%\Connection Wizard\Status\packed3.sbr
The worm stores created e-mail addresses in these files for easy access:
%system%\Connection Wizard\Status\sacri1.ggg
%system%\Connection Wizard\Status\sacri2.ggg
%system%\Connection Wizard\Status\sacri3.ggg
It searches the computer for files that have one of the following substrings in the file name or extension:
pmr phtm stm slk inbox imb csv bak imh xhtml
imm imh cms nws vcf ctl dhtm cgi pp ppt msg
jsp oft vbs uin ldb abc pst cfg mdw mbx mdx
mda adp nab fdb vap dsp ade sln dsw mde frm
bas adr cls ini ldif log mdb xml wsh tbb abx
abd adb pl rtf mmf doc ods nch xls nsf txt
wab eml hlp mht nfo php asp shtml dbx
If a matching file is found it hoards e-mail addresses from it, but does not keep those that have the following substrings in them:
ntp- ntp@ ntp. info@ test@ @www @from. support smtp- @smtp. gold-certs ftp. .dial. .ppp
.anyone subscribe announce @gmetref sql. someone nothing you@ user@ reciver@ somebody
secure whatever@ whoever@ anywhere yourname mustermann@ .kundenserver. mailer-daemon
variabel noreply -dav law2 .sul.t- .qmail@ t-ipconnect t-dialin ipt.aol time freeav @ca.
abuse winrar domain. host. viren bitdefender spybot detection ewido. emsisoft linux google
@foo. winzip @example. bellcore. @arin mozilla iana@ iana- @iana @avp icrosoft. @sophos
@panda @kaspers free-av antivir virus verizon. @ikarus. @nai. @messagelab nlpmail01. clock
There can be both English and German subjects and bodies.
In English:
One of following subjects is used.
Re:
Re: Your Password
Re: Registration Confirmation
Re: Your email was blocked
Re: mailing error
The body can contain the following strings:
Account and Password Information are attached!
Visit: http://www.[random_url]
This is an automatically generated E-Mail Delivery Status Notification.
Mail-Header, Mail-Body and Error Description are attached
Attachment-Scanner: Status OK,
AntiVirus: No Virus found
Server-AntiVirus: No Virus (Clean)
In German:
One of following subjects is used:
Ihr Passwort
Mail-Fehler!
Ihre E-Mail wurde verweigert
Ich bin's, was zum lachen ;)
Glueckwunsch: Ihr WM Ticket
WM Ticket Verlosung
WM-Ticket-Auslosung
The following lines are used to create the mail body:
Passwort und Benutzer-Informationen befinden sich in der beigefuegten Anlage.
Diese E-Mail wurde automatisch erzeugt
Mehr Information finden Sie unter http://www.[random_url]
Folgende Fehler sind aufgetreten:
Fehler konnte nicht Explicit ermittelt werde
Aus Datenschutzrechtlichen Gruenden, muss die vollstaendige E-Mail incl. Daten gezippt & angehaengt werden.
Wir bitten Sie, dieses zu beruecksichtigen.
Nun sieh dir das mal an!
Was ein Ferkel ....
Herzlichen Glueckwunsch
Weitere Details ihrer Daten entnehmen Sie bitte dem Anhang.
St. Rainer Gellhaus
--- Pressesprecher Jens Grittner und Gerd Graus
--- FIFA Fussball-Weltmeisterschaft 2006
--- Organisationskomitee Deutschland
--- Tel. 069 / 2006 - 2600
--- Jens.Grittner@ok2006.de
--- Gerd.Graus@ok2006.de
--- FIFA-Pressekontakt:
beim Run auf die begehrten Tickets fnr die 64 Spiele der Weltmeisterschaft 2006 in Deutschland sind Sie dabei.
Mail-Scanner: Es wurde kein Virus festgestellt
AntiVirus: Kein Virus gefunden
AntiVirus-System: Kein Virus erkannt
The attachments are zip packed and come with the following names:
account_info.zip
account_info-text.zip
error-mail_info.zip
LOL.zip
mail_info.zip
our_secret.zip
_PassWort-Info.zip
autoemail-text.zip
okTicket-info.zip
Fifa_Info-Text.zip
| 