Hai
Threat LevelDamageDistribution

Effects 

Hai does not have any destructive effects. Its only aim is to spread across local networks.

Infection strategy 

Hai follows the infection routine below:

• When it is run, this worm checks the IP address of the computer on which it has been run.
• Then, it tries to connect to the other computers in the same network.
• When it connects to other computers, it looks for the Windows directory in the shared folders with read and write access.
• When it finds the Windows directory, Haicopies itself to it under a random name.
• Hai modifies the WIN.INI file by entering the name of the file it has created in the code line Run=. By doing this, the worm ensures that it is run every time the affected computer is started up.
• In order to carry out this action, it uses a temporary file called WIN.HAI.

Means of transmission 

Hai spreads through local networks. It tries to connect through port 139 to the computers whose IP address is immediately before or after the IP of the computer it has infected. The algorithm used will be the following: IPBase+1, IPBase-1, IPBase+2, IPBase-2...

When it connects to a computer, it creates a copy of itself in the Windows directory.

Further Details  

Hai is written in the programming language Visual Basic, version 5.0.

The file that carries out the infection is a PE file. It is 60 Kbytes in size and compressed with the utility PELOCKnt, version 2.04.