Dumaru.Y and .Z
Zipped Picture Hides
a Malicious Surprise
26 January 2004
About the Virus
Two similar new variants of the Dumaru virus appeared on the Internet this weekend. The first Dumaru virus popped up last August, but did not spread enough to pose a serious threat. However, Dumaru.Y and .Z seem to have taken hold, probably because the virus payload travels as a compressed e-mail attachment. Such an approach may sneak past perimeter filtering, since most adminstrators allow .zip files to enter. If one of your users opens and runs Dumaru's zipped executable, the virus steals the victim's personal information and installs a back door that could allow the virus author full control of your user's computer.
Distinguishing Characteristics
Dumaru Y an Z always look the same. You'll recognize them easily:
From: "Elene"
FUCKENSUICIDE@HOTMAIL.COM
Subject: Important information for you. Read it immediately !
Body:
Hi! (In a large, red font)
Here is my photo, that you asked for yesterday.
Attachment: Myphoto.zip <-- (This zip file contains another file called, "Myphoto.jpg [lots of spaces] .exe"
In order to execute the virus, one of your users must first open Dumaru's zipped attachment, then run the executable within. If the user runs the executable, Dumaru installs itself in various locations on the user's machine and creates registry entries so that it can restart upon reboot. It also finds e-mail addresses on your user's computer and sends itself to them, using its own SMTP engine.
Next, Dumaru Y and Z contain malicious payloads. Both viruses log your user's keystrokes and monitor the clipboard. This allows the virus to gather sensitive data which might include passwords, credit card info, or proprietary information about your organization. The virus also monitors connections to egold.com in hopes of capturing user login information for that site. Dumaru e-mails all the data it gathers to the virus author's address, hardcoded within the virus.
Finally, Dumaru installs a back door on your user's computer that listens on TCP ports 2283 and 10000. This allows the virus author to issue instructions to your user's computer, essentially giving the attacker full control of the machine.
According to McAfee, Dumaru.Z differs from Dumaru.Y only in the size of its malicious payload and in that it downloads a spybot from a URL hard-coded within the virus.
What you can do
As always, remind your users never to open unexpected attachments from any source.
Most major anti-virus vendors already have signatures that detect both Dumaru Y and Z. Check with your vendor for the latest update, and make sure you've installed it.
Firebox II / III and Vclass owners should follow the steps below. The SMTP proxy can help.
Suggestions for SOHO owners
If you have a SOHO, your best bet to stop this worm is to get new virus definitions from your vendor. Don't open e-mail attachments unless they contain material you requested or expect. Scan e-mail attachments with your anti-virus software, and open them only if they prove clean.
If you use Outlook as your e-mail client, you might also set up a rule (Tools => Rules Wizard) that deletes all e-mails having Dumaru's "From:" address,
fuckensuicide@hotmail.com. This would be a tedious task for large networks because it has to be done at each machine, but administrators of small networks might feel the peace of mind from knowing your users won't have any opportunity to run Dumaru's executable is worth the extra labor.
Suggestions for Firebox II / III owners
The Firebox II and III's SMTP Proxy doesn't block .zip files by default. However, you can follow the steps below to block Dumaru's zip file either temporarily or permanantly. Note: if a future variant of Dumaru uses a different file name, this specific setting will no longer block it.
If you have an SMTP Proxy icon in the WatchGuard Policy Manager, double-click the icon, then go to Properties tab => Incoming => Content Types tab. Click the Add button and type myphoto.zip.
If you don't have an SMTP Proxy icon in the WatchGuard Policy Manager, go to: Edit => Add Service => Proxies => SMTP => Add => OK. Then configure the proxy to block Dumaru.Y and Z by following the steps in the bullet point above.
Suggestions for Vclass owners
Your Vclass does not block .zip files by default. You'll have to create or adjust a custom proxy action based on SMTP-Incoming in order to strip the newest Dumaru's .zip attachment. This does not prevent your users from receiving any zip file that has a different name.
If you have created your own Proxy Action based on SMTP-Incoming, you can edit it so that it blocks Myphoto.zip. In the Vcontroller software, click the Proxies button and double-click your custom proxy action. Under the Content Checking tab, change "Category" to Attachment Filename and click either the Add to Top or Insert After button (only one or the other will display). Next, type ZIP files as the new rule's name, and choose "Pattern Match." Next to Pattern Match, type Myphoto.zip and select Strip as the Action. Now you can apply this new Proxy Action to your SMTP rule to ensure Dumaru Y and Z are blocked.
symantec =
http://securityresponse.symantec.com...oval.tool.html
