Fake Twitter spam - Merond Worm
SonicWALL UTM Research team observed a new Merond worm variant being spammed in the wild via fake Twitter invitation e-mail messages. The e-mail message looks like below:
Sender: email@example.com [Spoofed sender address]
Subject: Your friend invited you to twitter!
Attachment: Invitation Card.zip [ Contains document.doc (spaces) .exe ]
The malicious executable inside the attachment is the new mass-mailing worm variant and the file looks like:
A sample e-mail message is shown below:
The worm when executed performs following activities on victim machine:
- Injects a malicious executable into multiple system files on the victim machine some of which are listed below:
- (System Folder)attrib.exe
- (System Folder)bootcfg.exe
- (System Folder)calc.exe
- (System Folder)chkdsk.exe
- Determines the IP address of the victim machine by sending a GET request to whatismyip.com
- Emails copy of itself to the e-mail addresses harvested from the victim machine
- Collects and sends back sensitive information from the victim machine to the predetermined IP address on port 65520. A sample encrypted packet is shown below:
- Downloads rogueware applications on victim machine.
This malware is also known as TR/Buzus.caro [AntiVir], Worm:Win32/Prolaco.gen!C [Microsoft], and Worm:W32/Prolaco.D [F-Secure].
SonicWALL Gateway AntiVirus provides protection against this malware via GAV: Merond.V (Worm) signature.