Worm.Win32.Flemin
Details
Worm.Win32.Fleming
Fleming is a malicious program that steals CD-Key information from the “Counter-Strike” and “Half-Life” games. It invites users to download this trojan program using Windows (.NET) Messenger. It also tries to download and install other malicious software from the Internet.
General Information
The worm program is a 32-bit Windows application (EXE file) written in Visual Basic, its size is 53248 bytes.
Fleming doesn’t install itself into the victim system, it runs only when it is executed by the victim (for example, by double-clicking its icon in Windows Explorer).
Payload
The worm program tries to download and execute two files located on the Internet at
http://home.no.net/downl0ad/
The files are downloaded and saved to the following locations:
C:\update35784.exe
C:\hehe2397824.exe
Next, the worm connects to Windows (.NET) Messenger and waits for incoming messages. If it receives proper messages from
styggefolk@hotmail.com
, it sends a response containing “Half-Life” and “Counter-Strike” CD-Key information.
Fleming searches for all Windows (.NET) Messenger contacts, and sends each entry the following message:
Worm.Win32.Fleming’s Windows Messenger Message:
Related Posts