W32/Stration.B Worm

 Information about the W32/Stration.B Worm:

W32/Stration.B is a mass mailing worm. This worm is a variant of W32/Stration.A. The worm will infect Windows systems and spreads through email.

The 'From' address of the infected mail will have one of the series of predetermined names, followed by random characters;

Moore2005@mail.com
Susan1952@yahoo.com
Greenpxjzx@fastmail.fm
Jennifer_ukawo@mail.com

The 'Subject' of the infected mail will be any one of the following;

test
Error
hello
Status
picture
Good Day
Server Report
Mail Delivery System
Mail Transaction Failed

The body of the infected mail will be any one of the following;

Mail transaction failed. Partial message is available.
The message contains Unicode characters and has been sent as a binary attachment.
The message cannot be represented in 7-bit ASCII encoding and has been sent as a binary attachment

The name of the infected attachment will be any one of the following;

doc
file
test
text
data
docs
body
readme
message
document

The infected attachment will have double extensions, the first extension can be any one of these;

.log
.elm
.msg
.txt
.dat

The second extension can be any one of these;

.scr
.pif
.bat
.exe
.cmd

It may also have blank spaces in between first and second extensions.

Upon execution of the infected attachment, the worm copies itself as SVCHOST32.EXE in the Windows folder.

It also copies cmut449c14b7.dll, hpz1449c14b7.exe and msji449c14b7.exe in the Windows System folder.

The worm modifies registry at the following location to load itself during each startup.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager

It opens notepad and displays random characters in a text file.

To propagate itself, the worm collects all the available email addresses from the files with following extensions and mails itself to these addresses using its own SMTP engine.

adb, asp, cfg, cgi, dbx, dhtm, eml, htm, html, jsp, mbx, mdx, mht, mmf, msg, nch, ods, oft, php, pl, sht, shtm, stm, tbb, txt, uin, wab, wsh, xls and xml

It attempts to connect to the following website to download a file.

http://thoteforo[Blocked].com/chr/fdv/lt

This worm first appeared on August 21, 2006.

 Other names of W32/Stration.B Worm:

This Worm is also known as W32.Stration.B@mm, WORM_STRATION.B .