This worm arrives as an attachment to an email message with the following content:
The subject of the email will be random, and will be the same as the file name of the email attachment.
The attachment is a file taken from the sender's computer and will have the extension .bat, .com, .lnk or .pif added to it.
The message body will be semi-random, but will always contain one of the following two lines (either English or Spanish) as the first and last sentences of the message.
Hola como estas ?
Nos vemos pronto, gracias.
Hi! How are you?
See you later. Thanks
Between these two sentences, some of the following text may appear:
Te mando este archivo para que me des tu punto de vista
Espero me puedas ayudar con el archivo que te mando
Espero te guste este archivo que te mando
Este es el archivo con la informaci=n que me pediste
I send you this file in order to have your advice
I hope you can help me with this file that I send
I hope you like the file that I sendo you
This is the file with the information that you ask for
When run, the worm performs the following actions:
- It creates copies of itself as %TEMP%\<File name> and C:\Recycled\<file name>, which contain the attached document. This document is then run using the program registered to handle the specific file type. For example, if it is saved as a file with the .doc extension, it will run using Microsoft Word or Wordpad. A file with the .xls extension will open in Excel, and one with the .zip extension will open in your default zip program, such as WinZip.
NOTE: The term %TEMP% is the Temp variable, and means that the worm will save itself to the Windows Temp folder, whatever its location. The default is C:\Windows\Temp.
- It copies itself to C:\Recycled\Sirc32.exe and %System%\Scam32.exe.
NOTE: %System% is also a variable. The worm will locate the \System folder (by default this is C:\Windows\System) and copy itself to that location.
- It adds the value
to the following registry key:
- It creates the following registry key:
with the following values:
- FB1B - Stores the file name of the worm as stored in the Recycled directory.
- FB1BA - Stores the SMTP IP address.
- FB1BB - Stores the email address of the sender.
- FC0 - Stores the number of times the worm has executed.
- FC1 - Stores what appears to be the version number of the worm.
- FD1 - Stores the file name of worm that has been executed, without the suffix.
- FD3 - Stores a value corresponding to the current state of the worm.
- FD7 - Stores the number of mails that have been sent prior to any interruption of this process.
- The (Default) value of the registry key
is set to
C:\recycled\sirc32.exe "%1" %*"
This enables the worm to execute itself any time that an .exe file is run.
- The worm is network aware, and it will enumerate the network resources to infect shared systems. If any are found, it will do the following:
- Attempt to copy itself to <Computer>\Recycled\Sirc32.exe
- Add the line "@win \recycled\sirc32.exe" to the file <Computer>\Autoexec.bat
- Copy <Computer>\Windows\Rundll32.exe to <Computer>\Windows\Run32.exe
- Replace <Computer>\Windows\rundll32.exe with C:\Recycled\Sirc32.exe
- There is a 1 in 33 chance that the following actions will occur:
- The worm copies itself from C:\Recycled\Sirc32.exe to %Windows%\Scmx32.exe
- The worm copies itself as "Microsoft Internet Office.exe" to the folder referred to by the registry key:
- There is a 1 in 20 chance that on October 16th of any year, the worm will recursively delete all files and folders on the C drive.
This payload functions only on computers which use the date format D/M/Y (as opposed to M/D/Y or similar formats).
Additionally, the payload will always activate immediately, regardless of date and date format, if the file attached to the worm contains the sequence "FA2" without the letters "sc" following immediately.
NOTE: Due to a bug in the initialization of a random number generator, it is highly unlikely that the file deleting, and space filling payloads of this threat will ever be activated.
- If this payload activates, the file C:\Recycled\Sircam.sys is created and filled with text until there is no remaining disk space. The text is one of two strings:
- [SirCam Version 1.0 Copyright ¬ 2000 2rP Made in / Hecho en - Cuitzeo, Michoacan Mexico]
- The worm contains its own SMTP engine which is used for the email routine. It obtains email addresses through two different methods:
- It searches the folders that are referred to by the registry keys
for sho*., get*., hot*., *.htm files, and copies email addresses from there into the file %system%\sc?1.dll
where ? is a different letter for each location, as follows:
- scy1.dll: addresses from %cache%\sho*., hot*., get*.
- sch1.dll: addresses from %personal%\sho*., hot*., get*.
- sci1.dll: addresses from %cache%\*.htm
- sct1.dll: addresses from %personal%\*.htm
- It searches %system% and all subfolders for *.wab (all Windows Address Books) and copies addresses from there into %system%\scw1.dll.
- It searches the folders referred to by the registry keys:
for files of type .doc, .xls, and .zip, and stores the filenames in %system%\scd.dll. One of these files will be appended to the worm's original executable and this new file will be sent as the email attachment.
The From: email address and mail server are taken from the registry. If no email account exists, then the current user name will be prepended to "prodigy.net.mx", eg if the current user logged on as JSmith, then the address will be "firstname.lastname@example.org". Then the worm will attempt to connect to a mail server. This will be either the mail server taken from the registry, or one of
The language used for the mail depends on the language used by the sender. If the sender uses Spanish, then the mail will be in Spanish, otherwise it will be in English. The attachment is chosen randomly from the list of files in the scd.dll.
Symantec Security Response encourages all users and administrators to adhere to the following basic security "best practices":