Aliases

SpamTool.Win32.Delf.h (Kaspersky Lab) is also known as: Spam-SPM (McAfee),   Trojan.MailSpam (Doctor Web),   Troj/Spexta-A (Sophos),   TROJ_DONBOMB.A (Trend Micro),   TR/Londrop (H+BEDV),   Trojan.DonBomb.A (SOFTWIN),   Trj/Bobin.A (Panda),   Win32/SpamTool.Delf.H (Eset)

Detection added	Jul 13 2005
Description added	Feb 14 2006
Behavior	SpamTool
Platform	Win32

Technical details

This program is designed to send spam to email addresses harvested from the victim computer. The program is a Windows PE EXE file 82432 bytes in size, written in Delphi and packed using UPX. The unpacked file is 232448 bytes in size.

Installation

SpamTool.Win32.Delf.h arrives as an attachment to infected messages.

Infected messages:

Sender:

CNN Newsletter

Message subject:

TERROR HITS LONDON

Attachment name:

LondonTerrorMovie.zip

The attached archive contains the following file:

Once launched, the program copies itself to the Windows root directory under one of the following names:

• %Windir%\ctflog.exe
• %Windir%\explore.exe
• %Windir%\inetinfomon.exe
• %Windir%\MPM.exe
• %Windir%\service.exe
• %Windir%\winlogon.exe

In order to make it more difficult for the files to be detected, it will be assigned the following attributes: Hidden, System, ReadOnly.

SpamTool.Win32.Delf.h then registers itself in the system registry, ensuring that it will be launched each time Windows is rebooted on the victim machine.

Payload

This program can be used to send to spam to email addresses harvested from the victim computer, and also to addresses created from random combinations of the elements below:

Name:

• about
• abrupt
• acetic
• actinolite
• Alana
• Alexandria
• Alvarado
• anarch
• apocryphal
• blacksmith
• blown
• bolometer
• Caldwell
• Carlos
• Carson
• codfish
• crystallite
• Cummings
• Curtis
• dairymen
• David
• deducible
• Dee
• detour
• diffusible
• diurnal
• Edward
• Ellis
• Fernandez
• french
• frostbite
• Hillary
• Hudson
• hydrochemistry
• Ivan
• Jimenez
• Kenneth
• loretta
• Luisa
• mail-hub
• mail-relay
• Malinda
• Mark
• Martinez
• Mccoy
• Mckinney
• mentor
• Oliver
• reactionary
• relay
• relay1
• relay2
• Ronald
• Scott
• Sharp
• slovakia
• Thomas
• Torres
• Victor
• Wagner
• Walton
• Williams
• wooden
• zeus

Domain:

• @aol.com
• @hotmail.com
• @msn.com
• @yahoo.com

The program is also able to download other malicious programs via the Internet and launch them on the victim machine.