|
 My
Doom Method of
Infection
This
malware trojan worm spreads by email and by
replicating itself to the shared directory for
Kazaa clients.
The
mailing component harvests addresses from the resident
computer system. Files with the following ext
are suspect:
wab
adb tbb dbx asp php sht htm txt pl
Additionally,
the worm contains strings, which it uses to randomly
generate, or guess, email addresses. These are added
as user names to perpetrated domains: sandra
julie jimmy jerry helen debby claudia brenda anna
alice brent adam ted fred jack bill stan smith steve
matt dave dan joe jane bob robert peter tom ray mary
serg brian jim maria leo jose andrew sam george david
kevin mike james michael john alex
 
Finally the
virus sends itself via SMTP - constructing messages
using its own such-SMTP component.
The worm
guesses the recipients email, and attaches the target
domain name with the following strings: mx
mail smtp mx1 mxs mail1 relay ns
The virus arrives
via email as follows:
Subject: Error
Status Server Report Mail Transaction Failed Mail
Delivery System hello hi
Body:
Various -Randomly generated
The
message has been sent as a binary attachment.and
therefore contains Unicode characters.
Mail
transaction failed.
Partial
message is available.
 
Attachment:
.bat .exe .pif .cmd .scr - often Zipped
on arrival (22,528 bytes) examples
doc.bat document.zip message.zip readme.zip
text.pif hello.cmd body.scr test.htm.pif data.txt.exe
file.scr
May be
multiple spaces for example:
document.htm
spaces .pif
 
Peer
To Peer Propagation
The worm copies itself to the KaZaa
Shared Directory with the following filenames: nuke2004
office_crack rootkitXP
strip-girl-2.0bdcom_patches
activation_crack icq2004-final
winamp
Remote
Access Component
MyDoom opens a connection on the TCP port
3127 or up to 3198 until successful and can accept
specially crafted TCP transmissions.
saves
the embedded binary into a temp file and executes it.
Then temp file is deleted.
can
relay TCP-packets providing spoofing
capabilities and thereby facilitates SPAM replication
channel for distribution
Denial
of Service Payload
DoS Begins On the first system
startup on February 1st or later. The worm
changes its behavior from mass emailing to DoS against
sco.com domain. This denial of service attack will
stop on the first system startup of February 12th
or later, and then will just monitor your PC Yikes
via the attached host port.
If
you open an affected attachment Notepad is opened
filled with a bunch of gobbledegook.
 
|
