|
Sunday, 01 January 2006 |
Trojan.Spamlia is a Trojan horse that sends SPAM email to all recipients in the Windows Address Book.
Type: Trojan Horse
Infection Length: 51,441 bytes
Systems Affected: Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows XP
Damage
Payload Trigger: n/a
Payload: Sends SPAM email.
Large scale e-mailing: n/a
Deletes files: n/a
Modifies files: n/a
Degrades performance: Sends SPAM email, which may clog mail servers or degrade network performance.
Causes system instability: n/a
Releases confidential info: n/a
Compromises security settings: n/a
Distribution
Subject of email: n/a
Name of attachment: n/a
Size of attachment: n/a
Time stamp of attachment: n/a
Ports: n/a
Shared drives: n/a
Target of infection: n/a
When Trojan.Spamlia executed, it performs the following actions:
Obtains all email addresses from the Windows Address Book and saves them to %Temp%~BG.
Note: %Temp% is a variable that refers to the Windows temporary folder. By default, this is C:WindowsTEMP (Windows 95/98/Me/XP) or C:WINNTTemp (Windows NT/2000).
May also obtain SMTP Display Name, SMTP Email Address, and SMTP Server information from the following registry entry:
HKEY_CURRENT_USERSoftwareMicrosoftInternet Account ManagerAccounts[RANDOM]
Sends SPAM email to all email addresses gathered from the Windows Address Book. The email contains the following characterstics:
Subject:
babbo natale indagato
Message:
evviva la stupidit!!
[DOMAIN]/video9.html
Della serie.... infierisci anche tu !!
buone feste! Buon anno!!!
[SMTP DISPLAY NAME]
Subject:
incoscienza natalizia
Message:
non fraintendere !!
[DOMAIN]/video8.html
Buone feste
[SMTP DISPLAY NAME]
Subject:
scherzo Natalizio
Message:
a natale si
tutti pi
imbranati
[DOMAIN]/video7.html
hehehe ciao tanti auguri
[SMTP DISPLAY NAME]
Subject:
video simpatico natalizio
Message:
scherzetto simpatico...eheheh
[DOMAIN]/video6.html
a presto, vi auguro buone feste
[SMTP DISPLAY NAME]
Subject:
da non perdere
Message:
lidiozia non manca mai nelle persone, soprattutto a natale, no comment
[DOMAIN]/video5.html
meglio non pensarci
tanti auguroni, ci sentiamo dopo le feste, a presto
[SMTP DISPLAY NAME]
Subject:
filmatino natalizio
Message:
in africa non importa che tu sia leone o gazzella, limportante
che...
[DOMAIN]/video4.html
a presto, auguri di buone feste e buon anno!
[SMTP DISPLAY NAME]
Subject:
natale: + buoni o + cattivi?
Message:
assolutamente da non fare !!
[DOMAIN]/video3.html
non
molto natalizio per
simpatico !!!
Ciao auguroni a tutti e buon anno!
[SMTP DISPLAY NAME]
Subject:
sorpresa natalizia
Message:
a natale dovremmo essere tutti pi
buoni, invece...
[DOMAIN]/video2.html
a presto e auguri anche alla famiglia
ciao, [SMTP DISPLAY NAME]
Subject:
video natalizio ?!
Message:
Stupidit
assoluta
[DOMAIN]/video1.html
ciao tanti auguri e buone feste
Subject:
babbo natale indagato
Message:
evviva la stupidit!!
[DOMAIN]/video9.html
Della serie.... infierisci anche tu !!
buone feste! Buon anno!!!
[SMTP DISPLAY NAME]
Subject:
incoscienza natalizia
Message:
non fraintendere !!
[DOMAIN]/video8.html
Buone feste
[SMTP DISPLAY NAME]
Subject:
scherzo Natalizio
Message:
a natale si
tutti pi
imbranati
[DOMAIN]/video7.html
hehehe ciao tanti auguri
[SMTP DISPLAY NAME]
Subject:
video simpatico natalizio
Message:
scherzetto simpatico...eheheh
[DOMAIN]/video6.html
a presto, vi auguro buone feste
[SMTP DISPLAY NAME]
Subject:
da non perdere
Message:
lidiozia non manca mai nelle persone, soprattutto a natale, no comment
[DOMAIN]/video5.html
meglio non pensarci
tanti auguroni, ci sentiamo dopo le feste, a presto
[SMTP DISPLAY NAME]
Subject:
filmatino natalizio
Message:
in africa non importa che tu sia leone o gazzella, limportante
che...
[DOMAIN]/video4.html
a presto, auguri di buone feste e buon anno!
[SMTP DISPLAY NAME]
Subject:
natale: + buoni o + cattivi?
Message:
assolutamente da non fare !!
[DOMAIN]/video3.html
non
molto natalizio per
simpatico !!!
Ciao auguroni a tutti e buon anno!
[SMTP DISPLAY NAME]
Subject:
sorpresa natalizia
Message:
a natale dovremmo essere tutti pi
buoni, invece...
[DOMAIN]/video2.html
a presto e auguri anche alla famiglia
ciao, [SMTP DISPLAY NAME]
Subject:
video natalizio ?!
Message:
Stupidit
assoluta
[DOMAIN]/video1.html
ciao tanti auguri e buone feste
[SMTP DISPLAY NAME]
Note:
[SMTP DISPLAY NAME] is the SMTP Display Name gathered from the registry entry listed above.
[DOMAIN] is one of following:
[http://]www.nice-movie-laugh.com/[REMOVED]
[http://]www.nice-movie-jokes.com/[REMOVED]
[http://]www.movielaugh.com/[REMOVED]
[http://]www.moviejump.com/[REMOVED]
[http://]www.movie-smile.com/[REMOVED]
[http://]www.goodmoviejokes.com/[REMOVED]
[http://]www.good-movie-smile.com/[REMOVED]
[http://]www.good-movie-play.com/[REMOVED]
[http://]www.good-movie-laugh.com/[REMOVED]
[http://]www.good-movie-jokes.com/[REMOVED]
[http://]www.goodmovielaugh.com/[REMOVED]
[http://]www.nicemoviesmile.com/[REMOVED]
[http://]www.nicemovieplay.com/[REMOVED]
[http://]www.nicemovielaugh.com/[REMOVED]
[http://]www.movie-play.com/[REMOVED]
[http://]www.movie-laugh.com/[REMOVED]
[http://]www.goodmoviesmile.com/[REMOVED]
[http://]www.goodmovieplay.com/[REMOVED]
Deletes itself and %Temp%~BG.
|
