Enciclopedia de Virus
Bienvenido a la Enciclopedia de Virus del Laboratorio de Panda Security.
Efectos
Nurech.A realiza las siguientes acciones:
- Finaliza los procesos que contengan cualquiera de las siguientes cadenas de texto:
anti
avg
avp
blackice
firewall
f-pro
hijack
lockdown
mcafee
msconfig
nav
nod32
rav
reged
spybot
taskmgr
troja
viru
vsmon
zonea
Estos procesos pertenecen en su mayoría a herramientas de seguridad, como programas antivirus y cortafuegos, entre otros. - Presenta funciones de rootkit, lo que le permite ocultar sus propios procesos.
Metodo de Infección
Nurech.A crea los siguientes archivos:
- Un archivo aleatorio con extensión EXE en el Escritorio. Este archivo es una copia del gusano.
- WINCOMS32.SYS, en el directorio de sistema de Windows. Este archivo corresponde al rootkit Nurech.A.
Nurech.A crea la siguiente entrada en el Registro de Windows:
- HKEY_LOCAL_MACHINE\ SYSTEM\ CurrentControlSet\ Services\ SharedAccess
Start
Método de Propagación
Nurech.A se propaga a través del correo electrónico. Para ello, realiza el siguiente proceso:
- Llega al ordenador en un mensaje de correo con las siguientes características:
Remitente:
Nurech.A falsifica la dirección que aparece como remitente del mensaje de correo que provoca la infección. La dirección falsificada está compuesta por uno de los siguientes nombres y un dominio:
Aldora, Alysia, Amorita, Anita, April, Aretina, Barbra, Becky, Bella, Bettina, Blenda, Briana, Bridget, Caitlin, Camille, Carla, Carmen, Chelsea, Clarissa, Damita, Danielle, Daria, Diana, Donna, Doris, Ebony, Eliza, Emily, Erika, Evelyn, Faith, Gilda, Gloria, Haley, Helga, Holly, Idona, Isabel, Ivana, Ivory, Janet, Jewel, Joanna, Julie, Juliet, Kacey, Kassia, Katrina, Laura, Linda, Lolita, Melody, Nadia, Naomi, Natalie, Nicole, Olivia, Pamela, Peggy, Queen, Rachel, Sharon, Silver, Valda, Valora, Vanessa, Vicky, Violet, Vivian, Wendy, Willa, Xandra, Xenia, Xylia, Zenia, Zilya.
Asunto: es variable, y puede ser uno de los siguientes:
1234567890
5 Reasons I Love You.
A
A Bouquet of Love, A Day in Bed Coupon Feeling Horny?, A Kiss So Gentle, A Little (sex) Card A Kiss for You, A Monkey Rose for You, A Red Hot Kiss, A Relaxing Coupon, A Romantic Place, A Song to You, A Special Kiss, A Sweet Love, Against All Odds, All For You For Better of For Worse To New Spouse, All That Matters, Awaiting Your Love.
B
Baby, Back Together, Between Us, Brand New Love, Breakfast in Bed Coupon Romantic Picnic Coupon, Bubble Bath Coupon.
C
Cuddle Up, Cyber Love.
D
Dancing, Dinner Coupon, Dream Date Coupon.
E
Emptiness Inside Me Our Love Everyday, Eternity of Your Love, Evening Romance Doing It for You, Every Inch of Your Body Ourlove is torn by miles, Everyone Needs Someone.
F
Falling In Love with You, Fields Of Love, For You Wish Upon a Star, For You....My Love, Forever in Love Full Heart.
H
Hand in Hand, He Blessed Our Lives, Heart is Breaking, Hold Me (distant love), Hold On You and I, How Much I Love You A, Hug & Roses, Hugging My Pillow, Hugs & Roses.
I
I Always Knew, I am Complete, I Am Lost In You, I Believe, I Can't Function, I Dream of you Dream Girl, I Give to You, I'll Be There Rose for my Love, I look at you You are out of this world, I Love Thee I'll Be Your Man, I Love You Mower, I Love You So, I Love You Soo Much Wrapped in Your Arms, I Love You with All I Am, I Luv U Crazy way to say I Luv U, I Still Love You, I Think of You, I Win with You, I wish Together Again You're so Far Away, I Woof You, I Would Do Anything You + Me, I Would Give you Anything, If I Could, If I Knew, In Love Love You Deeply The Long Haul, In My Heart From this day forward, Inside, Internet Love, It's Your Move.
J
Just You, Just You & Me.
K
Kisses.
L
Last Night was Hot! When, Let's Get Frisky, Love Birds, Love for Granted, Love is in the Air, Love Remains.
M
Massage Coupon, Memories, Miracle of Love A Token of My Love, Moonlit, My Heart belongs to you, My Heart is Thinking, My Heart The Miracle of Love Our Love is Strong, My Invitation, My Love Our Love is Free.
N
Now and Forever Without Your Love, Now I Know The Kiss.
O
Old Together, Only You, Our Love, Our Love Nest, Our Love Will Last, Our Two Hearts, Our Wedding Day Hey Cutie.
P
P.M.S, Passionate Kiss Kiss Coupon, Peek-A-Boo, Pockets of Love Live With Me.
R
Red Rose.
S
Safe With You, Search for One, Sending Kiss, Sending You My Love Magic of Flowers, So in Love, So Unique, Solitary Beauty Cuddle Me Please, Someone at Last Made for Each Other Safe and Sound, Soul Mates, Soul Partners, Steamy Dream, Steamy Sex Coupon, Summer Love A Weekend Getaway.
T
Take My Hand, Teddy Bear & Roses, Tender Whispers With This Ring, Thanks...Love, That Special Love, The Candle's Light, The Dance of Love, The Letter Bewitching Moonlight, The Love Bugs, The Mood for Love, The Sweet Taste of Love A Special Flower for You, The Time for Love, Thinking about you, Thinking of You Longing for You Twice Blest Forever and Ever, This Day Forward, This Feeling, Til the End of Time Heart of Mine, Till Morning's Light, Till Morninig's Light, Times Are Hard, Together You and I, Touched by Love Most Beautiful Girl Wrapped Up, Trunk Full Of Love, Twilight Paradise, Two of a Kind.
U
Unique Love My Eye on You, Unmatchable Beauty, Until the Day.
V
Vacation Love.
W
Waiting for You My Perfect Love True Love, Want to Meet?, Want You to Know, Waterfall, We Are Different, We Have Walked, We're a Perfect Fit, When I'm With You, When You Fall in Love, Why I Love You, Wild Nights--Wild Nights, Will You?, Window of Beauty, Wine and Roses, Wish I Could Tell You, With All My Love, With All of My Heart, With You, Won't you dance with me, Words I Write, Worthy of You.
Y
You and I Forever, You Are My Guiding Star Puppy Love, You Asked Me Why, You Brighten My Day Love at First Sight, You Lucky Duck!, You Rock Me!, You Were Worth the Wait Showers Of Love Can't Wait to See You!, Your Love Has Opened, Your Silly Smile, You're My Hero, You're Soo kissable Angel of Love, You're the One.
Contenido: está vacío.
Archivo adjunto: uno de los siguientes:
FLASH POSTCARD.EXE
GREETING CARD.EXE
GREETING POSTCARD.EXE
POSTCARD.EXE - El ordenador es afectado cuando se ejecuta el archivo adjunto.
- Nurech.A busca direcciones de correo electrónico en el ordenador afectado.
- Nurech.A envía una copia de sí mismo a las direcciones que ha recogido.
- Sin embargo, Nurech.A no se envía a ninguna dirección que contenga alguno de los siguientes dominios:
GOV
MIL
Otros Detalles
Nurech.A tiene un tamaño entre 30 y 52 Kbs, y está comprimido mediante UPX.