Aliases

Email-Worm.Win32.NetSky.q (Kaspersky Lab) is also known as: I-Worm.NetSky.q (Kaspersky Lab), W32/Netsky.ad@MM (NAI),   W32.Netsky.P@mm (NAV),   Win32.HLLM.Netsky.based (DrWeb),   W32/Netsky-P (Sophos),   Win32/Netsky.P@mm (RAV),   WORM_NETSKY.P (PCCIL),   Worm/NetSky.P.2 (H+BEDV),   W32/Netsky.P@mm (FPROT),   Win32:Netsky-P (AVAST),   I-Worm/Netsky.Q (AVG),   Win32.Netsky.P@mm (BitDef7),   Worm.SomeFool.P-dll (Clamav),   W32/Netsky.P.worm (Panda),   Win32/Netsky.Q (Nod32)

Description added	23 May 2005
Comportement	Email-Worm, ver de messagerie

Détails Techniques

Ce ver se propage via Internet sous forme de fichier attaché à des messages infectés. Il est capable de se propager via des réseaux P2P et des répertoires http et ftp accessibles.

Le composant principal du ver est un fichier PE EXE de 29 Ko environ. Le ver est compressé avec FSG; le fichier non compressé est de 40 Ko environ.

Installation

Le ver se copie dans le répertoire Windows sous le nom de fvprotect.exe et enregistre ce fichier dans la clef Autorun dans la base de registres :

[ HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
   "Norton Antivirus AV" = %windir\fvprotect.exe

Le ver crée aussi un fichier du nom de userconfig9x.dll dans le répertoire Windows, et des fichiers avec les noms suivants:

base64.tmp
 zip1.tmp
 zip2.tmp
 zip3.tmp

Ces fichiers sont des copies du ver en format UEE et des archives ZIP contenant des copies du ver. Les fichiers à l'intérieur de l'archive seront dénommés des façons suivantes:

document.txt.exe
 data.rtf.scr
 details.txt.pif

Le ver crée un mutex, ""_-oO]xX|-S-k-y-N-e-t-|Xx[Oo-_", pour indiquer sa présence dans le système.

Diffusion via email

Le ver cherche des fichiers aux extensions suivantes:

.eml
 .txt
 .php
 .asp
 .wab
 .doc
 .vbs
 .rtf
 .uin
 .shtm
 .cgi
 .dhtm
 .pl
 .htm
 .html
 .adb
 .tbb
 .dbx
 .sht
 .oft
 .msg
 .jsp
 .wsh
 .xml

et envoie ses copies aux adresses email récoltées dans ces fichiers. Le ver utilise sa propre bibliothèque SMTP pour envoyer des messages. Le ver tente également d'établir une connection directe avec le serveur destinataire.

Messages infectés:

Les messages infectés contiennent des combinaisons aléatoires parmi les options listées ci-dessous.

Adresse de l'expéditeur:

Choix aléatoire à partir des adresses collectées sur la machine victime

En-tête du message:

Re: Hi
 Re: Hello
 Re: Encrypted Mail
 Re: Extended Mail
 Re: Status
 Re: Notify
 Re: SMTP Server
 Re: Mail Server
 Re: Delivery Server
 Re: Request
 Re: Bad Request
 Re: Failure
 Re: Thank you for delivery
 Re: Test
 Re: Administration
 Re: Message Error
 Re: Error
 Re: Extended Mail System
 Re: Secure SMTP Message
 Re: Protected Mail Request
 Re: Protected Mail System
 Re: Protected Mail Delivery
 Re: Secure delivery
 Re: Delivery Protection
 Re: Mail Authentification
 Re: List
 Re: Question
 Re: Proof of concept
 Re: Developement
 Re: Message
 Re: Error in document
 Re: Free porn
 Re: Sex pictures
 Re: Submit a Virus Sample
 Re: Virus Sample
 Re: Old times
 Re: Old photos
 Re: Sample
 Re: Its me
 Re: Is that your document?
 Re: Approved document
 Re: Your document
 Protected Mail System
 Mail Authentication
 Is that your password?
 Private document
 Stolen document
 Mail Account
 Administrator
 Illegal Website
 Internet Provider Abuse
 Thank you!
 Congratulations!
 Postcard
 Your day
 Mail Delivery
 Error
 Shocking document
 You cannot do that!
 hi
 hello
 Fwd: Warning again
 Notice again
 Spamed?
 Spam
 0i09u5rug08r89589gjrg
 Re: A!p$ghsa
 Important m$6h?3p
 Do you?
 Does it matter?
 News
 Information
 I love you!
 I cannot forget you!
 here
 your
 my
 thanks!
 approved
 corrected
 patched
 improved
 important
 read it immediately

ou une chaine de caractères aléatoire

Corps du message:

Please see the attached file for details  
Please read the attached file! 
Your document is attached. 
Please read the document. 
Your file is attached. 
Your document is attached. 
Please confirm the document. 
Please read the important document. 
See the file. 
Requested file. 
Authentication required. 
Your document is attached to this mail. 
I have attached your document. 
I have received your document. The corrected document is attached. 
Your document. 
Your details.
Please confirm!
Please answer quickly!
Thank you for your request, your details are attached!
Thanks!
am shocked about your document!
Let'us be short: you have no experience in writing letters!!!
Try this, or nothing!
Here is it!
Do not visit this illegal websites!
You have downloaded these illegal cracks?
Here is my icq list.
Here is my phone number.
I have visited this website and I found you in the spammer list. Is that true?
Are you a spammer? (I found your email on a spammer website!?!)  
po44u90ugjid-k9z5894z0  
9u049u89gh89fsdpokofkdpbm3-4i  
Please r564g!he4a56a3haafdogu#mfn3o  
SMTP Error #201  
See the ghg5%&6gfz65!4Hf55d!46gfgf  
Server Error #203  
Your photo, uahhh.... , you are naked!
You have written a very good text, excellent, good work!
Your archive is attached.
Monthly news report.
lovely, :-)
your big love, ;-)
I hope you accept the result!
The sample is attached!
Your important document, correction is finished!
Important message, do not show this anyone!
Here is the website. ;-)
My favourite page.
I have corrected your document.
I have attached the sample.
Your bill is attached to this mail.
You were registered to the pay system.
For more details see the attachment.
Binary message is available.
Message has been sent as a binary attachment.
Can you confirm it?
I have attached it to this mail.
Please read the attached file.
Your document is attached.
Encrypted message is available.
Protected message is attached.
Please confirm my request.
ESMTP [Secure Mail System #334]:  Secure message is attached.
Partial message is available.
Waiting for a Response. Please read the attachment.
First part of the secure mail is available.
For more details see the attachment.
For further details see the attachment.
Your requested mail has been attached.
Protected Mail System Test.
Secure Mail System Beta Test.
Forwarded message is available.
Delivered message is attached.
Encrypted message is available.
Please read the attachment to get the message.
Follow the instructions to read the message. 
Please authenticate the secure message.
Protected message is attached.
Waiting for authentification.
Protected message is available.
Bad Gateway: The message has been attached.
SMTP: Please confirm the attached message.
You got a new message.
Now a new message is available.
New message is available.
You have received an extended message. Please read the instructions.
I noticed that you have visited illegal websites.
See the name in the list!

You have visited illegal websites.
I have a big list of the websites you surfed.

Your mail account is expired.
See the details to reactivate it.
 
Your mail account has been closed.
For further details see the document.

The file is protected with the password ghj001.
I have attached your file. Your password is jkl44563.
  
The sample file you sent contains a new virus version of mydoom.j.
Please clean your system with the attached signature.
Sincerly,
Robert Ferrew

Greetings from france,
your friend.
Have a look at these.

Best wishes,
your friend.
 
Congratulations!,
your best friend.

I found this document about you.
I cannot believe that.

Try this game ;-)
I hope the patch works.

La fin du message peut comporter de fausses informations comme quoi le message a été scanné et considéré sain par un produit antivirus:

+++ Attachment: No Virus found
 +++ MessageLabs AntiVirus - www.messagelabs.com


 +++ Attachment: No Virus found
 +++ Bitdefender AntiVirus - www.bitdefender.com


 +++ Attachment: No Virus found
 +++ MC-Afee AntiVirus - www.mcafee.com


 +++ Attachment: No Virus found
 +++ Kaspersky AntiVirus - www.kaspersky.com


 +++ Attachment: No Virus found
 +++ Panda AntiVirus - www.pandasoftware.com


 ++++ Attachment: No Virus found
 ++++ Norman AntiVirus - www.norman.com


 ++++ Attachment: No Virus found
 ++++ F-Secure AntiVirus - www.f-secure.com


 ++++ Attachment: No Virus found
 ++++ Norton AntiVirus - www.symantec.de

On trouve une large gamme de noms potentiels pour les fichiers attachés. Le fichier attaché a souvent une double extension, la première étant .doc ou .txt, et la seconde étant parmi la liste suivante:

exe
 pif
 scr
 zip

Le ver est capable de s'envoyer sous forme d'archive ZIP.

Le ver ne s'envoie pas à des adresses contenant les chaînes de mots suivantes:

@antivi
 @avp
 @bitdefender
 @fbi
 @f-pro
 @freeav
 @f-secur
 @kaspersky
 @mcafee
 @messagel
 @microsof
 @norman
 @norton
 @pandasof
 @skynet
 @sophos
 @spam
 @symantec
 @viruslis
 abuse@
 noreply@
 ntivir
 reports@
 spam@

Le ver peut envoyer des messages contenant l'exploit IFRAME, de la même façon que Klez.h et Swen. Lorsque c'est le cas, si le message est consulté à l'aide d'un client de messagerie vulnérable, le fichier d'archive contenant le ver sera lancé automatiquement.

Diffusion via P2P

Le ver crée des copies multiples de lui-même dans tous les sous-répertoires qui contiennent au moins un des mots de la liste suivante:

bear
 donkey
 download
 ftp
 htdocs
 http
 icq
 kazaa
 lime
 morpheus
 mule
 my shared folder
 shar
 shared files
 upload

Les fichiers crées par le ver auront les noms listés ci-dessous:

Kazaa Lite 4.0 new.exe
Britney Spears Sexy archive.doc.exe
Kazaa new.exe
Britney Spears porn.jpg.exe
Harry Potter all e.book.doc.exe
Britney sex xxx.jpg.exe
Harry Potter 1-6 book.txt.exe
Britney Spears blowjob.jpg.exe
Harry Potter e book.doc.exe
Britney Spears cumshot.jpg.exe
Harry Potter.doc.exe
Britney Spears fuck.jpg.exe
Harry Potter game.exe
Britney Spears.jpg.exe
Harry Potter 5.mpg.exe
Britney Spears and Eminem porn.jpg.exe
Matrix.mpg.exe
Britney Spears Song text archive.doc.exe  
Britney Spears full album.mp3.exe  
Eminem.mp3.exe  
Britney Spears.mp3.exe  
Eminem Song text archive.doc.exe  
Eminem Sexy archive.doc.exe  
Eminem full album.mp3.exe  
Eminem Spears porn.jpg.exe  
Ringtones.mp3.exe  
Eminem sex xxx.jpg.exe  
Ringtones.doc.exe  
Eminem blowjob.jpg.exe  
Altkins Diet.doc.exe  
Eminem Poster.jpg.exe  
American Idol.doc.exe  
Cloning.doc.exe  
Saddam Hussein.jpg.exe  
Arnold Schwarzenegger.jpg.exe  
Windows 2003 crack.exe  
Windows XP crack.exe  
Adobe Photoshop 10 crack.exe  
Microsoft WinXP Crack full.exe  
Teen Porn 15.jpg.pif  
Adobe Premiere 10.exe  
Adobe Photoshop 10 full.exe  
Best Matrix Screensaver new.scr  
Porno Screensaver britney.scr  
Dark Angels new.pif  
XXX hardcore pics.jpg.exe  
Microsoft Office 2003 Crack best.exe  
Serials edition.txt.exe  
Screensaver2.scr  
Full album all.mp3.pif  
Ahead Nero 8.exe  
netsky source code.scr  
E-Book Archive2.rtf.exe  
Doom 3 release 2.exe  
How to hack new.doc.exe  
Learn Programming 2004.doc.exe  
WinXP eBook newest.doc.exe  
Win Longhorn re.exe  
Dictionary English 2004 - France.doc.exe  
RFC compilation.doc.exe
1001 Sex and more.rtf.exe
3D Studio Max 6 3dsmax.exe
Keygen 4 all new.exe
Windows 2000 Sourcecode.doc.exe
Norton Antivirus 2005 beta.exe
Gimp 1.8 Full with Key.exe
Partitionsmagic 10 beta.exe
Star Office 9.exe
Magix Video Deluxe 5 beta.exe
Clone DVD 6.exe
MS Service Pack 6.exe
ACDSee 10.exe
Visual Studio Net Crack all.exe
Cracks & Warez Archiv.exe
WinAmp 13 full.exe
DivX 8.0 final.exe
Opera 11.exe
Internet Explorer 9 setup.exe
Smashing the stack full.rtf.exe
Ulead Keygen 2004.exe
Lightwave 9 Update.exe
The Sims 4 beta.exe

Autre

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

Explorer
 system. 
 msgsvr32
 winupd.exe
 direct.exe
 jijbl
 service
 Sentry
 au.exe
 direct.exe
 d3dupdate.exe
 OLE
 gouday.exe
 rate.exe
 Taskmon
 Windows Services Host
 sysmon.exe
 srate.exe
 ssate.exe
 winupd.exe

system. 
 Video

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices

HKLM\SYSTEM\CurrentControlSet\Services\WksPatch
 HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\PINF
 HKCR\CLSID\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InProcServer32