Feeds

The voodoo that Dumaru doesn’t do too well…

The worm turns

  • alert
  • submit to reddit

Using blade systems to cut costs and sharpen efficiencies

This weekend saw another iteration of email worm Dumaru. Unlike other email worm variants, Dumaru.J spreads itself by way of a zip attachment (rather than the typical executable). Of course, should users open the zipped file, and click the file ‘myphoto.jpg.56 (spaces). exe’ Dumaru does its typically annoying thing.

Dumaru is sent as an attached zip in an email with the subject line of 'Important information for you. Read it immediately!'. I f Dumaru.J is executed, it attempts to create a copy of itself in the Windows System directory as both l32x.exe and vxd32v.exe. Dumaru then attempts to save the file rundllx.sys in the Windows directory. Dumaru.J also attempts to save a copy of itself in the Windows Startup directory as dllxw.exe. Dumaru.J creates the file zip.tmp in the Windows Temp directory as a copy of the worm it e-mails to target addresses. The Windows registry
is modified to run the Trojan upon Windows start up:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
load32=C:\WINDOWS SYSTEM DIRECTORY\l32x.exe

Dumaru.J may also attempt to create the following registry key:

HKLM\Software\SARS

Once installed on an infected machine, Dumaru scans the hard drive for email addresses to which it sends itself via its own SMTP engine on port 25.

Perhaps the most worrying feature of the worm though, is that it opens and listens on TCP port 10,000 for remote commands, allowing unfettered system access.

Although AV vendors rate Dumaru as a low to mid priority threat the fact that it is transmitted as a zip file which many corporates allow, and when installed the worm can be used for remote access are causes for conceqrn.

As always, the advice is to update AV signatures. The initial infecting account appears to be the charmingly-titled ‘FUCKENSUICIDE@HOTMAIL.COM’, so it’s probably worth blocking that too…®

See below, for a screenshot of the offending email:

Dumaru screen shot

Boost IT visibility and business value

More from The Register

next story
Secure microkernel that uses maths to be 'bug free' goes open source
Hacker-repelling, drone-protecting code will soon be yours to tweak as you see fit
14 antivirus apps found to have security problems
Vendors just don't care, says researcher, after finding basic boo-boos in security software
Only '3% of web servers in top corps' fully fixed after Heartbleed snafu
Just slapping a patched OpenSSL on a machine ain't going to cut it, we're told
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
Israel's Iron Dome missile tech stolen by Chinese hackers
Corporate raiders Comment Crew fingered for attacks
Roll out the welcome mat to hackers and crackers
Security chap pens guide to bug bounty programs that won't fail like Yahoo!'s
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
Researcher sat on critical IE bugs for THREE YEARS
VUPEN waited for Pwn2Own cash while IE's sandbox leaked
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
Application security programs and practises
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
How modern custom applications can spur business growth
Learn how to create, deploy and manage custom applications without consuming or expanding the need for scarce, expensive IT resources.
Securing Web Applications Made Simple and Scalable
Learn how automated security testing can provide a simple and scalable way to protect your web applications.