W32/Stration.EC Worm

 Information about the W32/Stration.EC Worm:

W32/Stration.EC is a mass mailing worm. This worm is a variant of W32/Stration.A. The worm will infect Windows systems and spreads through email.

The infected email carries a spoofed 'From' address picked up randomly from the infected system.

The 'Subject' of the infected mail will be any one of the following;

Status
test
Mail Delivery System
Error
Mail server report
hello
Good day
picture
Server Report
Mail Transaction Failed

The body of the infected mail will be;

The message contains Unicode characters and has been sent as a binary attachment.

Mail server report.

Our firewall determined the e-mails containing worm copies are being sent from your computer.

Nowadays it happens from many computers, because this is a new virus type (Network Worms).

Using the new bug in the Windows, these viruses infect the computer unnoticeably.

After the penetrating into the computer the virus harvests all the e-mail addresses and sends the copies of itself to these e-mail addresses Please install updates for worm elimination and your computer restoring.

Best regards,
Customers support service

The message cannot be represented in 7-bit ASCII encoding and has been sent as a binary attachment.

Mail transaction failed. Partial message is available.

The name of the infected attachment will be any one of the following;

Update-KB{random numbers}-x86
doc
text
body
data
readme
message
docs
document
file
test

The infected attachment will have double extensions. The first extension will be any one of the following;

log
txt
dat
msg
elm

The second extension will be any one of the following;

exe
scr
bat
cmd
pif

Upon execution of the infected attachment, the worm copies itself as cserv32.exe, cserv32.wax and cserv32.s in Windows folder.

Also the worm copies itself as mslsicwd.dll, comrkbdd.exe, winftsap.dll, kbdpkbdr.exe, mrhomghxqe.exe, hhselz32.dll and winftsap.exe in Windows System folder.

The worm also injects the files e1.dll into several running processes.

The worm modifies registry at the following location to load itself during each startup;

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows

To propagate itself, the worm gathers all the available email address from Windows Address book(wab).

The worm mails itself to these addresses using its own SMTP engine.

It also attempts to connect to the following website to download malicious file;

http://www2.{BLOCKED}tinmdesachlion.com
www4.{BLOCKED}setikuinyunhderunsa.com

This worm first appeared on November 19, 2006.

 Other names of W32/Stration.EC Worm:

This Worm is also known as W32.Stration.EC@mm, WORM_STRAT.GG.