Visible Symptoms
- Security, Antivirus and debugging software programs
and services suddenly terminate after opening an email
attachment
- Creation of the file "msvgr.exe" into
the System32 folder
- Unable to connect with various security websites
after becoming infected
- High CPU usage and utilization due to routines of
the virus on an infected system
Detailed AnalysisThis variant of MyTob is very similar to existing variants
in that it is coded using Visual C, and contains instructions
to spread to other systems using SMTP email.
The virus also has the following characteristics -
- may connect to the IRC server
named "z101.sytes.net" and await commands
from a malicious user
- blocks certain AV and security
websites by altering the local "HOSTS" file
- may terminate firewall, security
or debugging applications, programs and processes
Loading at Windows startup
If the threat is run manually, it will copy itself to
the local system in several places -
C:\WINNT\system32\msvgr.exe
The virus is packed with a utility known as PESpin.
The virus will register itself to load at Windows startup
-
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
"MsWinVgr" = msvgr.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
"MsWinVgr" = msvgr.exe
App Termination Routine
The virus carries a list of applications, programs and
services that it will attempt to close or terminate
such as this short list of examples-
NEC.EXE
TASKMGR.EXE
CMD.EXE
_AVPM.EXE
_AVPCC.EXE
_AVP32.EXE
ZONEALARM.EXE
ZONALM2601.EXE
ZATUTOR.EXE
ZAPSETUP3001.EXE
ZAPRO.EXE
XPF202EN.EXE
WYVERNWORKSFIREWALL.EXE
WUPDT.EXE
WUPDATER.EXE
WSBGATE.EXE
WRCTRL.EXE
WRADMIN.EXE
WNT.EXE
WNAD.EXE
WKUFIND.EXE
WINUPDATE.EXE
WINTSK32.EXE
WINSTART001.EXE
WINSTART.EXE
WINSSK32.EXE
WINSERVN.EXE
WINRECON.EXE
WINPPR32.EXE
|
WINNET.EXE
WINMAIN.EXE
WINLOGIN.EXE
WININITX.EXE
WININIT.EXE
WININETD.EXE
WINDOWS.EXE
WINDOW.EXE
WINACTIVE.EXE
WIN32US.EXE
WIN32.EXE
WIN-BUGSFIX.EXE
WIMMUN32.EXE
WHOSWATCHINGME.EXE
WFINDV32.EXE
WEBTRAP.EXE
WEBSCANX.EXE
WEBDAV.EXE
WATCHDOG.EXE
W9X.EXE
W32DSM89.EXE
VSWINPERSE.EXE
VSWINNTSE.EXE
VSWIN9XE.EXE
VSSTAT.EXE
VSMON.EXE
VSMAIN.EXE
VSISETUP.EXE
VSHWIN32.EXE ... |
The list used by the virus is quite extensive.
SMTP mass-mailing routine
The virus has instructions to send a copy of itself
to contacts found in files of certain extensions. This
virus appears to have borrowed the same harvest and
exclusion routines as found in the W32/Mydoom virus
family. Email addresses are sampled from files having
these extensions -
- txt
- htm
- shtl
- jspl
- cgil
- xml
- php
- asp
- dbx
- tbb
- adb
- htm
- wab
The captured addresses are used as targets for the
mailing routine. As with other viruses using this technique,
the virus will avoid selecting email addresses containing
certain strings. The email message is crafted using
hard-coded values stored in the encrypte virus body.
The "From" address is spoofed and may use
one of three names, then associate them with the target
email address domain such as -
register@recipientdomain.com
mail@recipientdomain.com
administrator@recipientdomain.com
This is to add credibility to the email message, elevating
the chance the recipient will open the attachment.
The virus carries hard-coded message bodies and sends
email with varying body text. The possible body text
are selected from these choices, where "%s"
is the recipient's domain address -
Dear user %s,
You have successfully updated the password of your
%s account.
If you did not authorize this change or if you need
assistance with your account, please contact %s
customer service at: %s
Thank you for using %s!
The %s Support Team
+++ Attachment: No Virus (Clean)
+++ %s Antivirus - www.%s |
Dear user %s,
It has come to our attention that your %s User Profile
( x ) records are out of date. For further details
see the attached document.
Thank you for using %s!
The %s Support Team
+++ Attachment: No Virus (Clean)
+++ %s Antivirus - www.%s |
Dear %s Member,
We have temporarily suspended your email account
%s.
This might be due to either of the following reasons:
1. A recent change in your personal information
(i.e. change of address).
2. Submiting invalid information during the initial
sign up process.
3. An innability to accurately verify your selected
option of subscription due to an internal error
within our processors.
See the details to reactivate your %s account.
Sincerely,The %s Support Team
+++ Attachment: No Virus (Clean)
+++ %s Antivirus - www.%s |
Dear %s Member,
Your e-mail account was used to send a huge amount
of unsolicited spam messages during the recent week.
If you could please take 5-10 minutes out of your
online experience and confirm the attached document
so you will not run into any future problems with
the online service.
If you choose to ignore our request, you leave us
no choice but to cancel your membership.
Virtually yours,
The %s Support Team
+++ Attachment: No Virus found
+++ %s Antivirus - www.%s |
The email attachment will have a .ZIP file extension
and have names similar to these -
updated-password
email-password
new-password
password
approved-password
account-password
accepted-password
important-details
account-details
email-details
account-info
document
readme
account-report
Backdoor functionality
The virus connects with the IRC server 'z101.sytes.net'
in order to receive instructions from a malicious user.
Instructions include some of the following -
mailstart
mailstop
raw
remove
botcash
download
sysinfo
reconnect
disconnect
HOSTS modification routine
This variant alters the local "HOSTS" file
in an effort to block access to Antivirus and security
related web addresses. The virus overwrites the "HOSTS"
file with misconfigured information so that attempts
to reach certain addresses resolve to the IP 127.0.0.1,
also known as "localhost". The virus affects
connection attempts to the following domains -
www.symantec.com
securityresponse.symantec.com
symantec.com
www.sophos.com
sophos.com
www.mcafee.com
mcafee.com
liveupdate.symantecliveupdate.com
www.viruslist.com
viruslist.com
viruslist.com
f-secure.com
www.f-secure.com
kaspersky.com
kaspersky-labs.com
www.avp.com
www.kaspersky.com
avp.com
www.networkassociates.com
networkassociates.com
www.ca.com
ca.com
mast.mcafee.com
my-etrust.com
www.my-etrust.com
download.mcafee.com
dispatch.mcafee.com
secure.nai.com
nai.com
www.nai.com
update.symantec.com
updates.symantec.com
us.mcafee.com
liveupdate.symantec.com
customer.symantec.com
rads.mcafee.com
trendmicro.com
pandasoftware.com
www.pandasoftware.com
www.trendmicro.com
www.grisoft.com
www.microsoft.com
microsoft.com
www.virustotal.com
virustotal.com
www.amazon.com
www.amazon.co.uk
www.amazon.ca
www.amazon.fr
www.paypal.com
paypal.com
moneybookers.com
www.moneybookers.com
www.ebay.com
ebay.com
Miscellaneous
This virus has some text strings that are never
displayed but yield some insight into the recent surge
in MyTob variants -
H-E-L-L-B-O-T-P-O-L-Y-M-O-R-P-H
The source of this worm has been released to public.
irc server: irc.powerirc.net #ccpower . thx to everyone.
This virus creates the Mutex "H-E-L-L-B-O-T-P-O-L-Y-M-O-R-P-H"
when it is active. |