Yaha.Q, gusano infecta vía Correo y Redes con recursos compartidos, causa múltiples efectos nocivos. 

© Jorge Machado  Lima-Perú

Win32/Yaha.Q@MM, I-worm.Yaha.Q

Yaha.Q es la reciente variante de la familia de gusanos Yaha, reportada el 14 de Marzo del 2003, de propagación masiva a través mensajes de correo con Asuntos, Contenidos y archivos Anexados aleatorios con diversas extensiones. Usa su propio servidor SMTP (Simple Mail Transfer Protocol) y se auto-envía a los buzones de correo extraídos de diversas fuentes en los sistemas infectados. 

Infecta además vía Redes con recursos compartidos y causa múltiples efectos nocivos.

Es un PE (Portable Ejecutable) e infecta los sistemas operativos Windows 95/98/NT/Me/2000/XP, incluyendo los servidores NT/2000/2003 Server  

Está desarrollado en Visual C++, con una extensión de 43.5 KB y comprimido con el utilitario UPX (Ultimate Packer for eXecutables):

http://upx.sourceforge.net

Tiene una enorme variedad de formatos de mensajes de correo. 

Remitente, la dirección de correo es remitida desde el sistema infectado, pero es encubierta por cualquiera de las siguientes falsas direcciones (Email spoofing): 

Asuntos, cualquiera de los siguientes:

Anexados, cualquiera de los siguientes:

Contenidos, cualquiera de los siguientes:

Opción 1
hey, 
did u always dreamnt of hacking ur friends hotmail account.. 
finally i got a hotmail hack from the internet that really works.. 
ur my best friend thats why sending to u.. 
check it..just run it..enter victim's address and u will get the pass. 


Opción 2
hi, 
check the attached love screensaver 
and feel the fragrance of true love.. 

Opción 3
Hi, 
check the attached screensaver.. 
its really wonderfool.. 
i got it from freescreensavers.com 

Opción 4 
Hi, 
check ur friends circle using the attached friendship screensaver.. 
check the attached screensaver
and if u like it send it to all those you consider 
to be true friends... if it comes back to you then 
you will know that you have a circle of friends.. 

Opción 5 
Hi, 
check the attached screensaver 
and enjoy the world of friendship.. 

Opción 6
Hi, 
are u in a rocking mood... 
check the attached scrennsaver and start shaking.. 

Opción 7 
Hi, 
Check the attached screensaver.. 

Opción 8 
Hi, 
Are you lonely ??.. 
check the attached screensaver and 
forget the pain of loneliness

Opción 9 
Hi, 
Looking for online pals.. 
check the attached friend finder software.. 

Opción 10 
Hi, 
sending you a screensaver.. 
check it and let me know how it is... 

Opción 11 
Hi, 
Check the attached screensaver 
and feel the fragrance of true love... 

Opción 12 
Hey, 
I just got this wonderfull screensaver from freescreensaver.com.. 
Just check it out and let me know how it is.. 

Opción 13 
Hi, 
I just came across it.. check out.. 

================================================ 
Are you one of those unfortunate human beings who are desperately 
looking for friends.. but still not getting true friends with whom 
you can share your everything.. 

anyway you wont feel down any more cause GC Chat Network has brought 
up a global chat and online match making system using its own GC 
Messenger. Attached is the fully functional free version of GC 
Instant Messenger and Match Making client.. 
Just install, register an account with us and find thousands of online 
pals all over the world..
You can also search for friends by specific country,city,region etc. 

Regards Admin, 
GC Global Chat Network System.. 

Opción 14 
Hi, 
So you think you are in love.. 
is it true love ? you may think right now that you are in 
true love but it is certainly possible that it is nothing 
but a mere infatuation to you.. 

anyway to know yourself better than you have ever known check 
the attached screensaver and feel the fragrance of true love..

Opción15 
Hey pal, 
you know friendship is like a business... 
to get something you need to give something.. 
though its not that harsh as business but to 
get love and care from your friends you need to give 
love,care and respect to your friends.. right? 

check the attached screensaver and you will learn how to 
make your friends happy..

Opción 16 
Hi, 
Its quite obvious that in our life we have numerous friends 
but.. BUT Best Friend can only be ONE.. right ?? 
so can you decide who is your best friend ?? 
i guess not.. cause mostly you will find that your best friend 
wont care about u like somebody else.. 

anyway i found one way to find who is my best friend.. 
check it.. 
just check the attached screensaver.. answer some questions 
in it and also ask your best friend to answer the questions.. 

..then you will know more about him..

Opción 17 
Hey pal, 
wanna have some fun in life... 
feel like life is too boring and monotonous.. 
check the attached screensaver and bring colours 
to your black & white life.. :) 

Opción 19 
Hi, 
I just came across this funny screensaver.. 
sending it to u.. hope u like it.. 
check out and die laughing.. :) 

Opción 20 
<<<<<>>>>><<<<<>>>>><<<<<>>>>><<<<<>>>>><<<<<>>>>>

This E-Mail is never sent unsolicited. If you receive this 
E-Mail then it is because you have subscribed to the official 
newsletter at the KOF ONLINE website. 

King Of Fighters is one of the greatest action game ever made. 
Now after the mind boggling sucess of KOF 2001 SNK proudly 
presents to you KOF 2002 with 4 new charecters. 

Even though we need no publicity for our product but this 
time we have decided to give away a fully functional trial 
version of KOF 2002. So check out the attached trial version 
of KOF 2002 and register at our official website to get a free 
copy of KOF2002 original version 

Best Regards, 
Admin,KOF ONLINE.. 

<<<<<>>>>><<<<<>>>>><<<<<>>>>><<<<<>>>>><<<<<>>>>>
Opción 21 
Hello, 
I just came across your email ID while searching in the Yahoo profiles. 
Actually I want a true friend 4 life with whom I can share my everything. 
So if you are interested in being my friend 4 life then mail me. 

If you wanna know about me, attached is my profile along with some of my 
pics. You can check and if you like it then do mail me. 
I will be waiting for your mail. 

Best Wishes, 
Your Friend..

Opción 22 
Hello, 
Looking for some Hardcore mind boggling action ? 
Install the attached browser software and browse 
across millions of paid hardcore sex sites for free. 
Using the software you can safely and easily browse 
across most of the hardcore XXX paid sites across the 
internet for free. Using it you can also clean all 
traces of your web browsing from your computer. 

Note:The attached browser software is made exclusivley 
for demo only. You can use the software for a limited 
time of 35 days after which you have to register it 
at our official website for its furthur use. 

Regards, 
Admin.

Opción 23 
Klez.H is the most common world-wide spreading worm.It's very dangerous by corrupting your files. 
Because of its very smart stealth and anti-anti-virus technic,most common AV software can't detect or clean it. 
We developed this free immunity tool to defeat the malicious virus. 
You only need to run this tool once,and then Klez will never come into your PC 

Opción 24 
Hello, 
The attached product is send as a part of our official campaign 
for the popularity of our product. 
You have been chosen to try a free fully functional sample of our 
product.If you are satified then you can send it to your friends. 
All you have to do is to install the software and register an account 
with us using the links provided in the software. Then send this software 
to your friends using your account ID and for each person who registers 
with us through your account, we will pay you $1.5.Once your account reaches 
the limit of $50, your payment will be send to your registration address by 
check or draft. 

Please note that the registration process is completely free which means 
by participating in this program you will only gain without loosing anything. 

Best Regards, 
Admin,

Opción 25 
Hey listen pal, 
I am in big trouble.. 
Plz help me.. 
Check attached document.. 

Opción 26 
hi 
plz check the attached document.. 
and contact me as soon as possible..

Opción 27 
hi 
check this..

Opción 28 
wanna exchange.. 
I really like ur gift 
check the attached document.. 

Opción 29 
u shit... 
why the hell u send this to me.. 
i am returning ur document..

Opción 30 
I think u are in love... 
check the attached file.. 
Play the game of love..

Opción 31 
Plz check the attachment and plz dont be angry one me..

Opción 32 
ur system is infected with W32/Yaha.K 
use the attached patch to disinfect...

Opción 33 
hey pal 
I want to share a secret with u.. 
Check the attached document..

Opción 34 
Hi dear... checked the attached document.. 

Opción 35 
Attached is the Patch for OE 6 invalid MIME content vulnerability. 
This vulnerability may allow an attacker to execute any file 
without being opened.. 
Please use the attached program to patch up your system... 

Opción 36 
Hello, 
Attached is a set of hacking utilities developed by our programmers. 
We are distributing it freely for evolution purpose...

Opción 37 
Hi 
Check the attached Valentine Screensaver...

Opción 38 
Hi 
Check the attached Lovers Screensaver... 

Opción 39 
================================================= 
Are you one of those unfortunate human beings who are desperately 
looking for friends.. but still not getting true friends with whom 
you can share your everything.. 

anyway you wont feel down any more cause GC Chat Network has brought 
up a global chat and online match making system using its own GC 
Messenger. Attached is the fully functional free version of GC 
Instant Messenger and Match Making client.. 
Just install, register an account with us and find thousands of online 
pals all over the world.. 
You can also search for friends by specific country,city,region etc. 

Regards Admin, 
GC Global Chat Network System.. 

Opción 40 

<<<<<>>>>><<<<<>>>>><<<<<>>>>><<<<<>>>>><<<<<>>>>> 

This E-Mail is never sent unsolicited. If you receive this 
E-Mail then it is because you have subscribed to the official 
newsletter at our offical website. 

King Of Fighters is one of the greatest action game ever made. 
Now after the mind boggling sucess of KOF 2001 SNK proudly 
presents to you KOF 2002 with 4 new charecters. 

Even though we need no publicity for our product but this 
time we have decided to give away a fully functional trial 
version of KOF 2002. So check out the attached trial version 
of KOF 2002 and register at our official website to get a free 
copy of KOF2002 original version 

Best Regards, 
Admin,KOF ONLINE..

Al hacer clic en el archivo, el gusano se auto-copia a la carpeta %System% con los nombres wintask32.exe y exeLoader.exe y para activarse la próxima vez que se inicie el sistema crea la siguiente llave de registro:

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Windows Task" = "%System%\wintask32.exe"

El gusano además modificará la siguiente llave, agregando exeLoader.exe con el propósito de activarse cada vez que se ejecute cualquier archivo con extensión .EXE. 

[HKEY_CLASSES_ROOT\exefile\shell\open\command]
default = "%System%\exeLoader.exe "%1" %*

%System% es la variable C:\Windows\System para Windows 95/98/Me, C:\Winnt\System32 para Windows NT/2000 y C:\Windows\System32 para Windows XP.

El gusano libera y copia además el archivo TASKMGR32.DLL a la carpeta %System% y agrega las siguientes llaves de registro:

[HKEY_LOCAL_MACHINE\Software\Microsoft\WinVer] 
default = [cadena_de_6_letras]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Snakes]
“Version” = "2"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Snakes]
“Author” = "R0xx"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Snakes\Web]
"http://www.indiansnakes.cjb.net"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Snakes\Comments]
"This system belongs to the great Indians..."

(www.indiansnakes.cjb.net pertenece a un portal de hackers de la India que reta a hacktivistas de Pakistán, países que desde hace muchos años mantienen una relación hostil debido a pugnas políticas). 

Luego el gusano verifica la existencia de tres mutex (Exclusión Mutua), para evitar la generación de múltiples auto-copias y registrar sus infecciones:

Esta especie viral posee su propio SMTP (Simple Mail Transfer Protocol) y se auto-envía masivamente a todas las direcciones de correo del sistema infectado, capturados de las siguientes fuentes:

Al ser activado el gusano deshabilita los procesos de los siguientes antivirus, firewalls y sistemas de control:

Para propagarse a través de Redes el gusano busca el archivo WIN.INI, en los siguientes directorios de unidades de disco con con recursos compartidos:

Al hallar cualquiera de estos directorios, el gusano copia el archivo reg32.exe al WIN.INI y le agrega una línea:

WIN.INI
[windows]
run=%Windir%\reg32.exe

También busca en las siguientes rutas de las unidades de Red con recursos compartidos: 

Si encuentra cualquiera de estas carpetas, el gusano se autocopia con el nombre de MSRegScanner.exe 

Para provocar una Negación de Servicio crea la siguiente llave de registro:

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion]
ZoneCheck

Asimismo configura el registro para que el sistema se conecte a cualquiera de estos portales en Pakistán:

http://www.pakistan.gov.pk  (URL actualmente desactivado)
http://www.kse.com.pk         (URL actualmente desactivado)

En intervalos de segundos, el gusano envía peticiones HTTP a estos sitios web causando una saturación con el propósito de que los servidores se vuelvan lentos o hasta colapsen por una negación de Servicio .

El día Miércoles de cada semana el gusano se copia a las unidades de Red con recursos compartidos y configura la página de Inicio de Internet Explorer a:

http://www.indiansnakes.cjb.net 

El gusano libera un archivo con nombre aleatorio en el directorio %Windir% el cual contiene cualquiera de las siguientes cadenas de textos:

Texto 1 
 ================================================= 
iNDiAn snAKeS pReSAnTs : W32/yAHA 2.00 
wE aRe tHe gREaT inDIaNs 
--------------------------- 
thiS iS juST thE begiNNinG.. 
s00000 mUcH t0 c0mE.. 
n0 moRe pAK shiT wiLL be toleRATeD.. 
tiME f0r somE payBACK.. 
thERe iS nothING likE teAM w0rk.. 
iNDiAN snAKeS wiTH hARD p0iSoN.. 
wE wiLL bE BACk.... 
================================================= 
<> iNDiAn snAKeS <> 
* c0Bra 
* R0xx 
* kiNG c0Bra 
* snaKeEyEs 
* dEViL inCARnATe 
http://indiansnakes.cjb.net 

Texto 2 
================================================= 
iNDiAn snAKeS pReSAnTs : W32/yAHA 2.00 
wE aRe tHe gREaT inDIaNs.. 
------------------------------------------ 
ab0uT Yaha 2.00 : 
maIn miSsIon iS t0 dd0s 5 paKi weBshits.. 
fuCk paKi sYstEmS bY sEndinG eXploitEd daTa pAckeTs.. 
deDIcaTed to : 
* Trend Micro Corp ( f0r exceLLeNT anaLYsiS lolz ;) ) 
* Klez auTHoR 
* SQL Slammer auTHoR 
* inDIan haCKeRs & VXeRs 
* inDiAn s0 caLLeD IT eXpeRTs 
* pe0pLeS wh0 fiGHt agAINsT coRRupti0n ( i guEss itS alm0st NULL ) 
* aLL mEmbERs of iNDiAn sNAKeS 
* t0 mY bEsT friENd 
thIs iS a waR beTweeN inDia & paK hAckeRS.. 
n0 c0untrY shouLD gEt inVolvEd.. 
------------------------------------------ 
<<>> R0xx <<>> 
http://www.indiasnakes.cjb.net 
<qph@achayans.com> 
Texto 3 
 ================================================= 
iNDiAn snAKeS pReSAnTs : W32/yAHA 2.00 
wE aRe tHe gREaT inDIaNs 
------------------------- 
iNdIaN IT exPeRTs.. aRe u bUSy eArNiNg m0nEy ??? 
d0 s0mEthInG f0r uR c0untRY yaaaaar... 
c0mE aNd w0rK wIth uS.. 
bUt hEy wE aInT aNy IT eXpeRTs.. wHy ??? 
bEcAuSE wE d0nT hAvE ceRtiFicAtEs wHiCh u hAvE b0ugHt.. 
aLL wE aRe... wE aRe tHe gReAt iNdiAnS 
d0 u tHinK wE aRe g00d.. 
tHeN d0 a faVouR f0R uS.. juSt rEspEcT uS.. 
aND exPLaiN t0 uS.. whY u R n0t rEtaLiaTinG t0 pAkI hAckErS.. 
n0 0thEr sHiTs nEEdEd.. 
-------------------------------------------------
R0xx <qph@achayans.com> 
c0bra <c0bra@linuxmail.org> 
dEviL inCaRnaTE 666@achayans.com <mailto:666@achayans.com> 

Texto 4 
 ================================================= 
http://www.indiansnakes.cjb.net 
================================================= 
iNDiAn snAKeS pReSAnTs : W32/yAHA 2.00 
wE aRe tHe gREaT inDIaNs 
------------------------ 
to gigabyte :: chEErS pAL, kEEp uP tHe g00d w0rK..buT W32.HLLP.YahaSux is.. lolz ;) 
to Mr Roger Thompson :: 
| [technical director of malicious code research for TruSecure Corp] 
| --------------------------------------------- 
| wE arE n0t p0litiCaLy m0tiVatEd sIr... 
| wE aRe jUsT rEtaLiaTinG t0 pAkI hAckErS aNd tHeiR sHiT hAcktIviSm.. 
| hahha Yaha.K suCCessfuLL by lUck ??? eVeR heARd s0meThinG liKe thiS 
| a w0rM maDe anD spReaD bY luCk...hehehe lolz.. 
| aNd fiNallY wE kn0w dAmN weLL wHaT tHe heLL wE aRe doinG... 
| thE w0rlD pUshEd uS to tHe dArK siDe..cAnT hElp iT.. no reTReaT no suRRenDeR 
| ----------------------------------------------
================================================= 
bY R0xx ,c0bra,dEviL inCArNatE 
viSIt uS : <http://indiansnakes.cjb.net> 

Texto 5 
 ================================================= 
iNDiAn snAKeS pReSAnTs : W32/yAHA 2.00 
wE aRe tHe gREaT inDIaNs 
------------------------ 
sNAkE p0iSoN wiLL fUCk pAKIs 
n0w wE aRe a tEAm.. 
bEWarE oF tHe p0iSoN oF tHe snAKeS.. 
bACK oFF paKI hAckERs,uR dAyS aRe oVeR.. 
pAkIsTaN's IT fUtuRe iS iN uR hANd.. 
U sToP..wE sToP.. 
u sTarTeD.. wE fInIshED... 
================================================= 
bY R0xx,c0bra,dEviL inCArNatE 
visIT uS : http://indiansnakes.cjb.net 

Dentro del código viral se encuentran los nombres de los siguientes archivos, supuestamente para ser anexados a los mensaje de correo, sin embargo, los mismos no son enviados:

Yaha.Q tiene los siguientes payloads:

PER ANTIVIRUS® versiones 7.9 y 8.0 con registro de virus al 14 de Marzo del 2003 detectan y elimina eficientemente este gusano.

Ir al menú anterior

Regresar al Portal de PER SYSTEMS