Worm/Levona.A

File size: 43.008 Bytes

Aliases:
• Mcafee: W32/Avon@MM
• Kaspersky: Email-Worm.Win32.Levona.a
• TrendMicro: WORM_LEVONA.A
• VirusBuster: iworm I-Worm.Levona.A
• Eset: Win32/Levona.A worm
• Bitdefender: Win32.Worm.Levona.A

Platforms / OS:
• Windows 95
• Windows 98
• Windows 98 SE
• Windows NT
• Windows ME
• Windows 2000
• Windows XP
• Windows 2003

effects:
• Disable security applications
• Lowers security settings
• Registry modification

It copies itself to the following locations:
• %SYSDIR%\Emma.exe
• %SYSDIR%\Nova.exe
• %SYSDIR%\Alisa.exe
• %WINDIR%\Mstry.exe

• C:\Program Files\Common Files\Renova.exe
• D:\Program Files\Common Files\Renova.exe
• E:\Program Files\Common Files\Renova.exe
• F:\Program Files\Common Files\Renova.exe
• G:\Program Files\Common Files\Renova.exe

• c:\\winnt\regedit.exe
• c:\windows\regedit.exe
• c:\winnt\system32\regedit.exe
• c:\windows\system32\regedit.exe
• D:\winnt\regedit.exe
• D:\windows\regedit.exe
• D:\winnt\system32\regedit.exe
• D:\windows\system32\regedit.exe
• E:\winnt\regedit.exe
• E:\windows\regedit.exe
• E:\winnt\system32\regedit.exe
• E:\WINDOWS\system32\regedit.exe
• F:\WINNT\regedit.exe
• F:\WINDOWS\regedit.exe
• F:\WINNT\system32\regedit.exe
• F:\WINDOWS\system32\regedit.exe
• G:\WINNT\regedit.exe
• G:\WINDOWS\regedit.exe
• G:\WINNT\system32\regedit.exe
• G:\WINDOWS\system32\regedit.exe

• c:\windows\System\msconfig.exe
• c:\windows\system32\msconfig.exe
• c:\winnt\system32\msconfig.exe

It tries to executes the following files:

– Filenames:
• %SYSDIR%\Emma.exe
• %SYSDIR%\Alisa.exe

The following registry keys are added in order to run the processes after reboot:

– [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
• Renova = Nova.exe

– [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
• Shell = %PROGRAM FILES%\Common Files \Renova.exe

The following registry keys are added:

– [HKCU\Software\Policies\Microsoft\Windows\System]
• DisableCMD = 0

– [HKLM\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore]
• DisableConfig = 1
• DisableSR = 1

The following registry keys are changed:

– [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion]
Old value:
• ProductName = %user defined settings%
• RegisteredOrganization = %user defined settings%
• RegisteredOwner = %user defined settings%
• ProductId = %user defined settings%
New value:
• ProductName = RENOVA
• RegisteredOrganization = XENOVA
• RegisteredOwner = RENOVA
• ProductId = RENOVA

– [HKCU\Software\Microsoft\Windows\CurrentVersion]
Old value:
• RegisteredOrganization = %user defined settings%
• RegisteredOwner = %user defined settings%
• ProductId = %user defined settings%
• ProductName = %user defined settings%
New value:
• RegisteredOrganization = XENOVA
• RegisteredOwner = RENOVA
• ProductId = RENOVA
• ProductName = RENOVA

– [HKCU\Control Panel\Desktop]
Old value:
• AutoEndTasks = 0
New value:
• AutoEndTasks = 1

– [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot]
Old value:
• AlternateShell = cmd.exe
New value:
• AlternateShell = %PROGRAM FILES%\Common Files\Renova.exe

– [HKLM\SYSTEM\ControlSet%number%\Control \SafeBoot]
Old value:
• AlternateShell = cmd.exe
New value:
• AlternateShell = %PROGRAM FILES%\Common Files\Renova.exe

– [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
Old value:
• Shell = explorer.exe
• Userinit = explorer.exe
New value:
• Shell = explorer.exe %PROGRAM FILES%\Common Files\Renova.exe
• Userinit = explorer.exe %PROGRAM FILES%\Common Files\Renova.exe

Disable Regedit and Task Manager:
– [HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System]
New value:
• DisableRegistryTools = 1
• DisabletaskMgr = 1

– [HKCU\Software\Microsoft\Windows\CurrentVersionGroup Policy Objects\LocalUser\Software\Microsoft\ WindowsCurrentVersion\Policies\System]
New value:
• DisableRegistryTools = 1

Various Explorer settings:
– [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ AdvancedFolder\HideFileExt]
Old value:
• Type = checked
New value:
• Type =

– [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ Folder\Hidden\NOHIDDEN]
Old value:
• CheckedValue = %user defined settings%
• DefaultValue = %user defined settings%
New value:
• CheckedValue = 2
• DefaultValue = 2

– [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ AdvancedFolder\Hidden\SHOWALL]
Old value:
• CheckedValue = %user defined settings%
• DefaultValue = %user defined settings%
New value:
• CheckedValue = 1
• DefaultValue = 2

– [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ AdvancedFolder\HideFileExt]
Old value:
• CheckedValue = %user defined settings%
• DefaultValue = %user defined settings%
New value:
• CheckedValue = 1
• DefaultValue = 1

– [HKCU\Software\Microsoft\Windows\CurrentVersion\Explore\Advanced]
Old value:
• Hidden = %user defined settings%
• HideFileExt = %user defined settings%
New value:
• Hidden = 2
• HideFileExt = 1

– [HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
New value:
• NoDriveTypeAutoRun = 91
• NoSaveSettings = 0
• NoFolderOptions = 0
• NoFind = 1
• NoRun = 0
• NoControlPanel = 0

– [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer]
New value:
• NoFolderOptions = 0
• NoControlPanel = 0
• NoFind = 1
• NoRun = 0

It uses the Messaging Application Programming Interface (MAPI) in order to send a reply to emails stored in the inbox. The characteristics are further described:

From:
The sender address is the user's Outlook account.

Email design:

To: %original sender%
Subject: Re: %original subject%
Body:
• Sorry, Saya lupa nih :)
Attachment:
• Nova.scr

The attachment is a copy of the malware itself.
The email looks like the following:

In order to infect other systems in the Peer to Peer network community the following action is performed: It retrieves the shared folder by querying the following registry key:
• \Software\Kazaa\Transfer\DlDir0

List of processes that are terminated:
• GUNBLADE.EXE
• CAV.EXE

Processes with one of the following strings are terminated:
RABIAH; RABI'AH; MANTIK; PLATO; KINDI; IMAMAH; MATURID; HARUN NAS; IZUTSU; TEOLOGI; SUFI; PARTAI; HASAN ALBANA; IKHWANUL MUSLIMIN; TAHRIR; ARISTOTELES; GIBRAN; GHAZALI; IHYA; GENDER; PLURALISME; SYIAH; SYI'AH; DEMOCRA; DEMOKRA; LIBERAL; TASAWUF; SAMIR; YUNAN; QUTH; EMANSIP; PHILOSOP; MUTAZILAH; MU'TAZILAH; FILOSOF; FILSAFAT; REALPLAYER; CLEANER; MOVZX; REMOVER; ZANDA; MACHINE; CILLIN; CILIN; AVAST; GRISOFT; PROCEXP; NORTON; EARTHLINK PROTECTION; WASHER; ERTANTO; COMPACTBYTEAV; ADVANCED REGISTRY TRACER; KILL; CASTLECOPS; SOPHOS; F-SECURE; REGISTRYFIX; PANDA; SECUNIA; TREND; SYMANTEC; KASPERSKY; AVG; MCAFEE; NVC; NORMAN; VAKSIN; HACKER; COMMAND PROMPT; PROCESS EXPLORER - SYSINTERNALS; SYSTEM32; PCMAV; HIJACK; KILLBOX; FOLDER OPTION; CMD; WORM; TROJAN; VIRUS; ANTI; COMMAND BRO!!!; COMMAND BRO !!!; JOWOBOT; FAJAR; SATRIO; KANTUK; KANGEN; CUEX; EVANTA; BORAX; TITTA; CODE-X; MONTELLA; MONTELA; FERDINAND; CAMPBEL; CRUZ; ADRIANO; KAHN; RECOBA; FIGO; RAUL; GONZALES; CISSE; GERRAD; LAMPARD; TERRY; RIVALDO; GATUSO; GATTUSO; VAN DE; SHEARER; AIMAR; CLAUDIO; LOPEZ; TOLDO; CANNAVARO; NESTA; UMIT; HAKAN; LARSON; LARSSON; ETO O; ETO'O; MOVIC; MIDO; FABREGAS; HENRY; BARTHEZ; MANCINI; GILARD; BATIGOL; BATISTUA; TOTTI; COLE; OWEN; DIDA; RONALDINHO; TREZEG; ROBINHO; CARLOS; ROBERTO; RONALDO; MARADONA; PELE; VIDUKA; SALAS; KEWEL; PERUZZI; HOWARD; ZANETI; ZANETTI; GIGGS; ROONEY; BUFFON; VIERI; PIRLO; KAKA; ZLATAN; DECO; SHEVA; SHEVCHENKO; INZAGHI; PIERO; BECKHAM; BOCA J; BORDEUX; MONACO; MUNICH; MUNCHEN; DORTMUND; LEVERKUSEN; SEVILLA; VALENCIA; BARCA; BARCEL; MADRID; PARMA; LAZIO; ROMA; INTER; MILAN; JUVE; NEWCASTLE; LIVERPOOL; ARSENAL; CHELSEA; MANCHESTER; CUMBU; KISS; CIUM; RAYU; JULIET; ROMEO; VALENTINE; HENTAI; MANGA; ANIM; SUCK; FUCK; NAKE; NUDE; TEEN; GIRL; PORN; SEKS; SEX; THOMAS; JEREM; MAYANG S; NIA R; ZAYANT; DEWI; ANJASMARA; DIAN S; DIAN N; SOPIA; SOPHIA; MAYANG SARI; CUT KEKE; FEBIOLA; FEBY; JIHAN; CUT TARI; RIKE DIAH; WIBOWO; SARAH; AZAHRI; AZHARI; RIRIN; RATNASARI; TAMARA; ZUBIR; PRIMUS; REVALDO; ENNO LERIAN; ENO LERIAN; DIAH; KADIR; DOYOK; ULFA; KOMENG; JENIFER; JENNIFER; DICAPRIO; KRISTIN; ANGELLI; LEONARDO; KATE WIN; EMMA WATSON; HARY POTTER; HARRY POTTER; GOSSIP; GOSIP; SASTRA; SENI; ARTIS; BOLYWOOD; HOLYWOOD; SINETRON; VAGANZA; CELEBRI; SELEB; TSUBASA; SLAM DUNK; SAMURAI-X; SAMURAI X; HATTORI; HATORI; KABUTO; SHIZUKA; DORAEMON; NOBITA; INUYASHA; KENSHIN HIMURA; KOTARO MINAMI; KYOKO; EMIKO SHIRATORI; FAYE WONG; UEMATSU; NUOBUO; NOUBUO; NOBUO; NUBUO; MADONNA; MADONA; BENNINGTON; BENINGTON; GUN AND ROSE; GUN N ROSE; BLUR; SAMMY; PEARL; NAZARE; FRENTE; CRANBER; RADIOHEAD; RADIO HEAD; STING; SAYBIA; KEANE; GROBAN; ALTER; STEFAN; GWEN; MAROON; ANTHEM; GROOVE COVARAGE; PRODIGY; AGUILERA; BEDING; METALLICA; GUN N'ROSES; ALICIA KEYS; TATA YOUNG; BOY ZONE; MICHEL; MICHAEL; MICHEAL; MLTR; MARTYN; MARTIN; SCORPION; LINKIN PARK; LINKINPARK; GREEN DAY; GREENDAY; HOOBASTANK; PETER; WEST; SPICE; BRITNEY; DEDI DOR; NIA DANIAT; DAHLIA; NIKE ARD; BAGASKARA; KATON; NAFF; TITIK PUSPA; TITIEK PUSPA; DELON; SNADA; JOSHUA; SHERINA; SERIEUS; SERIUES; SEURIUS; 10 2 5; TENTOFIVE; TEN2FIVE; 10 TO 5; TEN TO FIVE; TEN 2 FIVE; CHRISYE; SO7; SHEILA; GLENN; AURIL; AVRIL; OPICK; AGNES; ANANG; NUGIE; HADAD; HADDAD; AB THREE; REZA; CAFEIN; CAFFEIN; RATU; RADJA; LALUNA; THE RAIN; UTOPIA; SPARK; BASEJAM; ENDANK; JAVA JIVE; MARCEL; BUNGLON; ANDRE HEHANU; FLANELA; BAIM; CANDIL; KOES P; MINORU; NUNO; YOVI; AUDY; TERE; WAYANG; BASE JAM; JIKUSTIK; SAMSON; PAS BAND; BOOMERANG; NAIF; COKELAT; KAPTEN BAND; TIC BAND; JAMRUD; KOTAK BAND; AMERICAN IDOL; INDONESIAN IDOL; TEAM LO; BUNGA; TIPE-X; TIPE X; ELEMENT; EMINEM; RAIHAN; RAYHAN; MELY; MELLY; UNGU; STINGKY; SLANK; INUL; PADI; IWAN FAL; ADABAND; ADA BAND; ROSA; KRISDAYANTI; NURHALIZA; DEWA; ARY LASO; ARY LASSO; ARI LASO; ARI LASSO; GIGI; THE 0THERS; CHEER; DANCE; SING; SONG; MP 3; MP3; MARAWIS; NASYID; DANGDUT; MELODI; MELODY; SENANDUNG; IRAMA; GITAR; GUITAR; NYANYI; LAGU; WINAMP; MUSIK; MUSIC; DANIAT; PHILOSO; FUNNY; MALAS; SOUND; JPG; JPEG; RAGNAROK; FANTASY; IKHWANUL; ARISTO; PLURAL; GAME; DEMOC; DEMOK; FAKE; NORWE; REMOVE; PROTECT; COMPACT; REGISTRY; CASTLE; SOPH; SECUR; MCAFE; DEEP; HIJA; VIR; CRACK; HACK; ACT; BECK; GAMB; FOTO; PHOTO; KASIH; TUNANG; PACAR; CINTA; LOVE; JULIE; ROME; VALENT; LEONARD; KATE W; EMMA WAT; HARY; POTTER; HARRY; ART; BOLY; HOLY; SINE; EMIKO; WONG; FAYE; UEMA; NUO; NOB; NUB; MADO; BENING; BENNING; ROSE; GUN; ZONE; BOY; MICH; MART; SCORP; LINKIN; GREEN; HOOB; RIF; DEDI D; NIKE; PUSPA; JOSH; SHERIN; TEN TO; TEN 2; CHRIS; POTRET; NUGI; AUDI; AMERICA; ELEMEN; DANG

The active processes memory is searched for the following strings. If successful the processes become terminated.:
XMPLAYER.EXE; REALPLAY.EXE; ACDSEE.EXE; ALOGSERV.EXE; CM GRDIAN.EXE; CMGRDIAN.EXE; RULAUNCH.EXE; VSMAIN.EXE; AVPCC.EXE; AVPM.EXE; AVP32.EXE; AVWUPSRV.EXE; AVGNT.EXE; AVWIN.EXE; AVGEMC.EXE; AVGWB.DAT; AVGCC.EXE; TROJAN GUARDER.EXE; ASHSIMPL.EXE; ASHQUICK.EXE; OPERA.EXE; FIREFOX.EXE; IEXPLORE.EXE; TASKMGR.EXE; EMUSICCLIENT.EXE; ART.EXE; NAVW32.EXE; CCLAW.EXE; NVCOD.EXE; WINAMP.EXE

Processes containing one of the following window titles are terminated:
CompactbyteAV; Advanced Registry Tracer; Setup - iKnowPS; iKnowPS; RamCleaner; System Cleaner; TuneUp RegistryCleaner; Antivirus Scanner; Zanda's little helper; Norman Generic Fix; NVC v5.81 Setup; Norman Virus Control - InstallShield Wizard; Process Explorer - Sysinternals: www.sysinternals.com; Pocket Killbox; RegCleaner 4.1 by Jouni Vuorio; Security Task Manager Versi shareware tanpa registrasi; Security Task Manager; Installation; EULA; PowerDVD; Windows Media Player; Microsoft Configuration Utility; System Restore; System Configuration Utility; Restrictions; Registry Editor; Close Programs; Close Program; Task Manager; Windows Script Host; HijackThis; HijackThis - v1.99.1; Getting Started with Windows 2000; Folder Options

Mutex:
It creates the following Mutexes:
• Renova Aliciana
• Renova Emira

Programming language:
The malware program was written in MS Visual C++.


Runtime packer:
In order to aggravate detection and reduce size of the file it is packed with the following runtime packer:
• UPX