| Malware name | Worm.McMaggot.A | | Type | Worm | | Affected platform | Win32 | | Media-Type | application/executable | | MD5 checksum | 0AA203943D1E264973B2993CA09EF4C3 | | Static file | yes | | Filesize | 449,024 Bytes | Alias names
(also known as) | | Sophos | W32/Autorun-RI | | McAfee | W32/Xirtem@MM | | CA ETrust | Win32/Mytob.OO |
| | Side effects | - Drops a malicious file
- Uses its own Email engine
- Lowers security settings
- Registry modification
| | Propagation | Email |
|
Description:
Files
It copies itself to the following location:
• %SYSDIR%\vxworks.exe
The following file is created:
– %SYSDIR%\qnx.exe Furthermore it gets executed after it was fully created. Further investigation pointed out that this file is malware, too. Detected as:
4200 Registry
One of the following values is added in order to run the process after reboot:
– HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
• Wind River Systems"="c:\windows\\system32\\vxworks.exe
The following registry keys are changed:
– HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\AuthorizedApplications\List
New value:
• c:\windows\\system32\\vxworks.exe"="c:\windows\\system32\\vxworks.exe:*:Enabled:Explorer
Email
It contains an integrated SMTP engine in order to send emails. A direct connection with the destination server will be established. The characteristics are described in the following:
From: The sender address is spoofed.
The sender of the email is one of the following:
• giveaway@mcdonalds.com
• noreply@coca-cola.com
• postcards@hallmark.com
Subject: One of the following:
• Coca Cola is proud to accounce our new Christmas Promotion.
• Mcdonalds wishes you Merry Christmas!
• You've received A Hallmark E-Card!
Attachment: The filename of the attachment is one of the following:
• coupon.zip
• postcard.zip
• promotion.zip
The attachment is an archive containing a copy of the malware itself.
File details
Programming language:
The malware program was written in MS Visual C++.
Runtime packer: In order to aggravate detection and reduce size of the file it is packed with a runtime packer.
