Alias/es

Visible Symptoms

• This variant includes an EPOC executable with .EXE extension and named as "cwoutcast.exe"
  
  
• This virus spreads to Series 60 mobile devices that run Symbian operating system.

Detailed Analysis

This threat may arrive as an installable Symbian archive file (with .SIS file extension). The recipient will first notice a request to receive the "program" (virus) in the form of a simple question dialogue window. The message may be similar to the one below -

Receive message via Bluetooth from %phone model%?
Yes	No

The virus is persistent such that even after pressing "No" that multiple requests could be received in numerous requests. The barrage of requests could prove to be too many and quite annoying to mobile device owners receiving the request, and could subsequently give in and allow the virus to be received and thus installed, infecting the device.

Upon installation, the virus will create a subfolder in the "System\Apps" folder -

system\apps\symcommander

In this folder, the virus will drop two Symbian executable files (and two related files) -

cwoutcast.exe (40,432 bytes)
symcommander.app (27,040 bytes)

symcommander.aif (806 bytes)
symcommander.rsc (409 bytes)

This virus file uses two general spreading methods - using Bluetooth and MMS. In order to use both, the virus uses imports from several system .DLLs in order to help spread to other phones -

Bluetooth wireless libraries
BLUETOOTH.DLL
SDPAGENT.DLL
SDPDATABASE.DLL

Telephony server libraries
ETEL.DLL
GSMBAS.DLL - GSM extension
GSMU.DLL - GSM MMS Stack

IrDA libraries
IROBEX.DLL - IrDA object exchange protocol

The virus seeks phones nearby using Bluetooth protocol. For every device found, the virus will send attempt to send itself to that device. The virus also browses the phone contact list and sends an MMS message containing a copy of the virus to the contacts listed. The MMS message attachment is a randomly named .SIS Symbian installer containing a copy of the virus.

Miscellaneous
The virus file "cwoutcast.exe" contains the following strings -

CommWarrior Outcast: The dark side of Symbian Force. CommWarrior v2.0-PRO. Copyright (c) 2005 by e10d0r CommWarrior is freeware product. You may freely distribute it in it's original unmodified form. With best regards from Russia. OTMOP03KAM HET!

The virus file "symcommander.app" contains the following strings -

Symbian Commander Version 1.05 A.Prokofiev UNTEH 2005

 

Recommended Action

• Delete all modules related to this virus from the infected device -
  
  \system\apps\symcommander\cwoutcast.exe
  \system\apps\symcommander\symcommander.app
  \system\apps\symcommander\symcommander.aif
  \system\apps\symcommander\symcommander.rsc