Buzus.GDEF – Mass-Mailing Worm (Feb 18, 2011)
SonicWALL UTM Research team received reports of a new variant of mass-mailing worm propagating in the wild. This worm propagates through emails,P2P applications, network and removable drives.
Process of Infection:
An unsuspecting user may receive an email with the malware attachment. This worm can send emails as follows:
From: invitations@twitter.com
Subject: Your friend invited you to Twitter!
Attachment: Invitation Card.zip
From: order-update@amazon.com
Subject: Shipping update for your Amazon.com order
Attachment: Shipping documents .zip
From: update@facebookmail.com
Subject: You have got a new message on Facebook!
Attachment: Facebook message.zip
From: e-cards@hallmark.com
Subject: You have received A Hallmark E-Card!
Attachment: Postcard.zip
From: invitations@hi5.com
Subject: Laura would like to be your friend on hi5!
Attachment: Invitation Card.zip
From: resume-thanks@google.com
Subject: Thank you from Google!
Attachment: CV-20100120-112.zip
It may also send a phishing email:
Installation:
Once the user opens and executes the attachment, it will do the following:
Drops a copy of itself:
- WINDOWSsystem32PCSuite.exe – [ detected as GAV: Buzus.GDEF (Trojan) ]
- WINDOWSsystem32sta-css.exe – [ detected as GAV: (Cloud) Mufanom.APSW (Trojan) ]
- WINDOWS{random}.dll – [ detected as GAV: (Cloud) Mufanom.APSW (Trojan) ]
- WINDOWSsystem32stat-cpe.exe – [ detected as GAV: Twain.A (Trojan) ]
Registry Changes
Adds the following registry entries to ensure that the malware runs on every system startup.
- HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun
Value: Nokia Launch Application
Data: “C:WINDOWSSystem32PCSuite.exe” - HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun
Value: Yravasaxog
Data: “WINDOWSw3dyu1.dll”,Startup””
Added the following registries as part of its installation:
- Key: HKEY_CURRENT_USERSoftwareNokia4
- Key: HKEY_LOCAL_MACHINESoftwareNokia4
- HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorer nok01 “11”
- HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorer nok01 “24”
- HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionpoliciessystem EnableLUA dword:00000000
- HKEY_LOCAL_MACHINESOFTWAREMicrosoftSecurity CenterUACDisableNotify InNewValue dword:00000001
Adds following registry entry to bypass firewall restrictions:
- Key: [HKLMSYSTEMCurrentControlSetServicesSharedAccessParametersFirewallPolicyStandardProfileAuthorizedApplicationsList] Value: “C:WINDOWSsystem32PCSuite.exe”
Data: “C:WINDOWSsystem32PCSuite.exe:*:Enabled:Explorer”
Mutex
Creates this mutex to ensure only a single instance is running in the memory.
- PCSuite.exeDm28sf0V@XK$NX8hOu
Propagation
Removable Drives
Drops Autorun.inf and copy of itself as redmond.exe on and removable drives.
- [autorun]
open= RECYCLER S-1-6-21-2434476521-1645641927-702000330-1542redmond.exe
icon=%SystemRoot%system32SHELL32.dll,4
action=Open folder to view files
shellopen=Open
shellopencommand= RECYCLER S-1-6-21-2434476521-1645641927-702000330-1542redmond.exe
shellopendefault=1
Peer-2-Peer Application
May copy itself in the following folders using listed filenames below:
Folder:
- C:program filesicqshared folder
- C:program filesgrokstermy grokster
- C:program filesemuleincoming
- C:program filesmorpheusmy shared folder
- C:program fileslimewireshared
- C:program filesteslafiles
- C:program fileswinmxshared
- C:Downloads
Filename:
- Ad-aware 2010.exe
- Adobe Acrobat Reader keygen.exe
- Adobe Illustrator CS4 crack.exe
- Adobe Photoshop CS5 crack.exe
- Alcohol 120 v1.9.7.exe
- Anti-Porn v13.5.12.29.exe
- AnyDVD HD v.6.3.1.8 Beta incl crack.exe
- Ashampoo Snap 3.02.exe
- AVS Video Converter v6.3.1.365 CRACKED.exe
- BitDefender AntiVirus 2010 Keygen.exe
- Blaze DVD Player Pro v6.52.exe
- CleanMyPC Registry Cleaner v6.02.exe
- Daemon Tools Pro 4.50.exe
- Divx Pro 7 + keymaker.exe
- Download Accelerator Plus v9.exe
- Download Boost 2.0.exe
- DVD Tools Nero 10.5.6.0.exe
- G-Force Platinum v3.7.5.exe
- Google SketchUp 7.1 Pro.exe
- Grand Theft Auto Episodes From Liberty City 2010.exe
- Image Size Reducer Pro v1.0.1.exe
- Internet Download Manager V5.exe
- Kaspersky AntiVirus 2010 crack.exe
- K-Lite Mega Codec v5.5.1.exe
- K-Lite Mega Codec v5.6.1 Portable.exe
- LimeWire Pro v4.18.3.exe
- MagicISO Magic ISO Maker v5.5.0276 Cracked.exe
- McAfee Total Protection 2010.exe
- Microsoft.Windows 7 ULTIMATE FINAL activator+keygen x86.exe
- Motorola
- Mp3 Splitter and Joiner Pro v3.48.exe
- ms09-067.exe
- Myspace theme collection.exe
- Nero 9 9.2.6.0 keygen.exe
- Norton Anti-Virus 2010 crack.exe
- Norton Internet Security 2010 crack.exe
- PCSuite.exe
- PDF password remover (works with all acrobat reader).exe
- PDF to Word Converter 3.0.exe
- PDF Unlocker v2.0.3.exe
- PDF-XChange Pro.exe
- Power ISO v4.2 + keygen axxo.exe
- Rapidshare Auto Downloader 3.8.exe
- RapidShare Killer AIO 2010.exe
- Sony Vegas Pro v9.0a incl crack.exe
- Sophos antivirus updater bypass.exe
- Starcraft2 battle.net key generator.exe
- Starcraft2 battle.net keys.txt.exe
- Starcraft2.exe
- Starcraft2 REGION-UNLOCKER.exe
- Starcraft2 SERVER-CHANGER.exe
- Super Utilities Pro 2009 11.0.exe
- Total Commander7 license+keygen.exe
- Trojan Killer v2.9.4173.exe
- Tuneup Ultilities 2010.exe
- Twitter FriendAdder 2.1.1.exe
- Uniblue RegistryBooster 2010.exe
- VmWare 7.0 keygen.exe
- VmWare keygen.exe
- Winamp.Pro.v7.33.PowerPack.Portable+installer.exe
- Windows 2008 Enterprise Server VMWare Virtual Machine.exe
- Windows2008 keygen and activator.exe
- Windows 7 Ultimate keygen.exe
- Windows XP PRO Corp SP3 valid-key generator.exe
- WinRAR v3.x keygen RaZoR.exe
- YouTubeGet 5.4.exe
- Youtube Music Downloader 1.0.exe
Email Propagation
Harvests email addresses from files with the following extensions:
- asp
- dbx
- doc
- htm
- log
- lst
- nfo
- php
- rtf
- txt
- wab
- wpd
- wps
- xls
- xml
It avoids sending email with addresses having the following strings:
- .com
- .gov
- .mil
- abuse
- acd-group
- acdnet.com
- acdsystems.com
- acketst
- admin
- ahnlab
- alcatel-lucent.com
- anyone
- apache
- arin.
- avg.comsysinternals
- avira
- badware
- berkeley
- bitdefender
- bluewin.ch
- borlan
- bpsoft.com
- bsd
- bugs
- buyrar.com
- ca
- certific
- cisco
- clamav
- contact
- debian
- drweb
- eset.com
- example
- f-secure
- fido
- firefox
- fsf.
- ghisler.com
- gimp
- gnu
- gold-certs
- gov.
- help
- honeynet
- honeypot
- iana
- ibm.com
- icrosoft
- idefense
- ietf
- ikarus
- immunityinc.com
- info
- inpris
- isc.o
- isi.e
- jgsoft
- kaspersky
- kernel
- lavasoft
- linux
- listserv
- mcafee
- me
- messagelabs
- mit.e
- mozilla
- mydomai
- no
- nobody
- nodomai
- noone
- not
- nothing
- novirusthanks
- ntivi
- nullsoft.org
- page
- panda
- pgp
- postmaster
- prevx
- privacy
- qualys
- quebecor.com
- rating
- redhat
- rfc-ed
- root
- ruslis
- sales
- samba
- samples
- secur
- security
- sendmail
- service
- site
- slashdot
- soft
- somebody
- someone
- sopho
- sourceforge
- spam
- spm
- ssh.com
- submit
- sun.com
- support
- suse
- syman
- tanford.e
- the.bat
- unix
- usenet
- utgers.ed
- virus
- virusbuster
- webmaster
- websense
- winamp
- winpcap
- wireshark
- www.ca.com
- www
- you
- your
Queries available Mail-Exchange Server to send the email:
Other System Modification:
Delete files from the following directories:
- Program Filesprevx
Delete files related to the following registry entry:
- HKEY_LOCAL_MACHINESOFTWAREMcAfeeAVEngine szInstallDir = “mcshield.exe”
- HKEY_LOCAL_MACHINESOFTWAREMalwarebytes’ Anti-Malware InstallPath = *.*”
Terminates the following services related to AV security softwares:
- AVP
- AntiVirSchedulerService
- Arrakis3
- CSIScanner
- CaCCProvSP
- ERSvc
- Ehttpsrv
- Emproxy
- FPAVServer
- GWMSRV
- K7EmlPxy
- K7RTScan
- K7TSMngr
- LIVESRV
- LiveUpdate Notice Service
- MBAMService
- MCNASVC
- MPFSERVICE
- MPS9
- McAfee HackerWatch Service
- Norton AntiVirus
- PANDA SOFTWARE CONTROLLER
- PAVFNSVR
- PAVPRSRV
- PAVSVR
- PSHOST
- PSIMSVC
- PSKSVCRETAIL
- RSCCenter
- RSRavMon
- SAVScan
- SUM
- Savadminservice
- Savservice
- Sophos Agent
- Sophos Autoupdate Service
- Sophos Certification Manager
- Sophos Management Service
- Sophos Message Router
- Symantec Core LC
- TPSRV
- ThreatFire
- VSSERV
- WerSvc
- WinDefend
- XCOMM
- antivirservice
- avast! Antivirus
- avast! Mail Scanner
- avast! Web Scanner
- avg8emc
- avg8wd
- bdss
- ccEvtMgr
- ccproxy
- ccpwdsvc
- ccsetmgr
- ekrn
- liveupdate
- mcODS
- mcmisupdmgr
- mcmscsvc
- mcpromgr
- mcproxy
- mcredirector
- mcshield
- mcsysmon
- msk80service
- navapsvc
- npfmntor
- nscservice
- sbamsvc
- scan
- sdauxservice
- sdcodeservice
- sndsrvc
- spbbcsvc
- wscsvc
C&C Server
Sends information to the following remote server:
- 153.26.137.241
Anti-debugging Technique
Checks for the following SoftIce Debugger driver:
- \.SICE
- \.NTICE
- \.SIWVIDSTART
Anti-VMware:
Checks if its running in VMWare
- \.VMDRV
SonicWALL Gateway AntiVirus provides protection against this worm via the following signatures:
GAV: Buzus.GDEF (Trojan) (Trojan)
GAV: Twain.A (Trojan)
GAV: Mufanom.APSW (Trojan)
GAV: (Cloud) Mufanom.APSW (Trojan)
