Risiko: sehr gering
Typ: Wurm
entdeckt am: 18.05.2006
auch bekannt als: keine Angabe
Information:
SymbOS.Commwarrior.G is a worm that runs on Series 60 phones. It attempts to spread using Bluetooth and Multimedia Messaging Service (MMS) messages, and Multmedia Cards (MMC) as a randomly named .sis file.
technische Details:
When SymbOS.Commwarrior.G is executed, it performs the following actions:
Displays a dialog box to warn the user that the application may be coming from an untrusted source and may cause potential problems before the .sis file is installed.
If the user clicks yes, the device displays the following message prompting the user to install the threat:
Install
Mp3 UltraDJ
Creates the following files:
[DriveLetter]\system\apps\NokiaPlayer\MusicPlayer.exe (a copy of SymbOS.Commwarrior.D)
[DriveLetter]\system\apps\NokiaPlayer\Inition.mdl
Runs ultraplayer.exe, which creates the following files on the compromised device's memory card:
e:\system\recogs\inition.mdl
e:\system\wmedias\inition.mdl
e:\system\wmedias\MusicPlayer.exe
Rebuilds a .sis file from the above files and copies it to the following location:
e:\system\wmedias\Codec.sis
Searches for Bluetooth-enabled devices and attempts to send a randomly named copy of the .sis file to all devices that it finds, repeating this action every minute.
Selects a contact phone number from the device's phonebook at random and sends an MMS message containing the Codec.sis file as an attachment. The MIME type of the attachment is application/vnd.symbian.install. The message is one of the following:
Subject: Mierda Estatut!!
Message: PoltiTonos paramoviles,descarga ya!
Subject: Comela!
Message: Nuevo Virus THX para los Nokia s60s. Instala
Subject: Quieres Reirte
Message: Todos vendemos. Gracias Carod!
Subject: Morena
Message: Conseguir eso.. Maldito Sea!
Subject: PC-CITY
Message: Carod eres un cabron, Estatuto. Politonos de Neng !!. Follatela!
Subject: Mis Albumes
Message: Valencia,ciudad de Campeones. Viva el VCF!Solo Nokia.
Subject: Sonitonos Nokia
Message: Politono Popcorn anuncio renault clio
Subject: Carod Rovira HPuta!
Message: Vodafone y Amenase fusionan. Compra un Nokia.com
Subject: A mi novia Less
Message: Solo trabajemos 6 horas diarias .....!
Subject: Se busca gente
Message: Manda tu curriculum a esta direcciony llamaran!
Subject: Antena 3 y Telecinco...
Message: Diapositiva PowerPoint ensymbian.com
Subject: Mi e-mail es este
Message: Mario y yo nos casamos en 2 meses!!.
Subject: Feliz Cumple!!!
Message: Felicidades!!!! Tienes una postal aki!
Subject: Orgullo Gay
Message: Descarga nuevos sonitonos aqui!
Subject: Mi Exnovia!
Message: Mp3 Player para Nokia series 60. Instalalo yaa!
Subject: Mi foto erotic@
Message: Coleccion de mis fotoalbum fallas 2006!!!
Subject: Quedamos a tomar algo?
Message: Viva las fallas de Valencia, mascletas online
Subject: Ayudanos co
Message: ntra la drogadiccion, colabora ACDV 1 Euro.
Subject: Me he cambiado..
Message: Me he cambiado la direccion de email, esta
Subject: Llamame cuando veas
Message: Problema de bateria en Nokia!
Subject: Cari!!
Message: AMD!!!Universidad de Madrid y Valencia.
Subject: Nuevas Tiendas!
Message: Hay que pagar para respirar y mear
Subject: Movistar!
Message: Fernando Alonso te envia una invitacion!Sr Arganda
weitere Informationen...