Win32/Brontok [Threat Name] go to Threat

Win32/Brontok.T [Threat Variant Name]

Category	worm
Size	42065 B
Detection created	Nov 21, 2005
Detection database version	1296
Aliases	Email-Worm.Win32.Brontok.q (Kaspersky)
	W32/Rontokbro.gen@MM (McAfee)
	W32.Rontokbro@mm (Symantec)

Win32/Brontok.T is a worm that spreads via e-mail and shared folders.

When executed the worm copies itself in the following locations:

The file is copied in the following folders as well:

The filename used is the same as the name of a file already present in a particular folder.

An additional ".exe" extension is appended.

In order to be executed on every system start, the worm sets the following Registry entries:

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
- "Bron-Spizaetus" = "%windir%\ShellNew\bronstab.exe"
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
- "Tok-Cirrhatus" = "%userprofile%\Local Settings\Application Data\smss.exe"

The following Registry entries are set:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell]
- "Explorer.exe" = "%windir%\eksplorasi.exe"
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\Policies\System]
- "DisableRegistryTools" = 1
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\Policies\System]
- "NoFolderOptions" = 1
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\Policies\Explorer]
- "DisableCMD" = 0
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\advanced]
- "Hidden" = 0
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\advanced]
- "ShowSuperHidden" = 0
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\advanced]
- "HideFileExt" = 1

The worm schedules a task that causes the following file to be executed daily:

The worm replaces the following file by one downloaded from the Internet:

This blocks access to several Internet servers.

The following files are deleted:

The worm may delete various other files.

E-mail addresses for further spreading are searched for in local files with one of the following extensions:

Addresses containing the following strings are avoided:

The sender address is one of the following:

The message depends entirely on data the worm downloads from the Internet.

The worm searches for various shared folders.

The executables of the worm are copied there using a filename of a file already present in the folder.

An additional ".exe" extension is appended.

Alternatively, the following name may be used:

It also copies itself into the root folders of removable drives.

The following text is displayed:

BRONTOK.A[10]
-- Hentikan kebobrokan di negeri ini --
1. Penjarakan Koruptor, Penyelundup, Tukang Suap, & Bandar NARKOBA
( Send to "NUSAKAMBANGAN")
2. Stop Free Sex, Aborsi, & Prostitusi
( Go To HELL )
3. Stop pencemaran lingkungan, pembakaran hutan & perburuan liar.
4. SAY NO TO FRUGS !!!
-- KIAMAT SUDAH DEKAT --
Terinspirasi oleh:
Elang Brontok (Spizaetus Cirrhatus) yang hampir punah
[ By: HVM31 ]
- -- JowoBot #VM Community --
- !!! Akan Kubuat Mereka (VM lokal yg cengeng & bodoh) Terkapar !!!

The following programs are terminated:

The worm restarts the operating system if there is a window with any of the following strings in the name:

The worm performs DoS attack against 2 servers.

The worm tries to download a file from the Internet. The file is then executed.