#CUTE WRITER MALWARE PORTABLE#
#CUTE WRITER MALWARE WINDOWS#

We put a breakpoint and let the execution continue until it reached that point. The instructions between PUSHAD and POPAD contain the decompression routine of UPX and after that we get to the first instruction of the original sample, in other words, the program without packer. We scrolled down until the POPAD instruction was found. It is common to find this instruction on the executables packed with UPX. We opened the sample in OllyDbg and the first instruction found was PUSHAD (that sends the content of the general purpose registries to the stack in this order:EAX, ECX, EDX, EBX, EBP, ESP, ESI y EDI). It was not possible to unpack the sample automatically, so we proceeded to do it manually. However, when we tried to unpack it with the UPX executable, the following error appeared: It detected that the worm was compressed and protected with UPX. For this, we used a tool called RDG Packer Detector. The next step was to discover whether the sample was packed or not. As mentioned before, it is likely that the malware writer was trying to make the sample appeared as legitimate screensaver by adding information such as вЂњLegalCopyrightвЂќ and вЂњLegalTrademarksвЂќ. The following strings, which we had seen before on the fileвЂ™s properties, were obtained after analyzing the file with BinText.

#CUTE WRITER MALWARE PORTABLE#

Further down, the header of the Portable Executables вЂњPEвЂќ could be seen.ДЄfter scrolling down a little thereвЂ™s a curious detail: the malware writer managed to make a reversed heart appear in hex, as shown on the image below. Following are the details obtained from one of the variants of the Yaha/Lentin family.Д«efore executing the sample again to analyze it dynamically, a static analysis was performed to obtain more information.ДЇirst, we opened the file with a hexadecimal editor as it was expected, at the beginning the file contained the magic number of the executables for MS-DOS environments, 4D 5A, which in ASCII is equivalent to вЂњMZвЂќ. The messages that were displayed on the screen were these:Д®ven though this effect may seemвЂ¦ cute, the malware carried out other actions that were certainly not nice while the user watched the animation. This animation continued until the user pressed a key or moved the mouse. Once it was executed, several messages of different colors, with ValentineвЂ™s Day related phrases appeared throughout the screen: first one message, then the screen trembled and finally the phrase changed. The file was obtained with the вЂњexeвЂќ extension, which was replaced by the вЂњscrвЂќ extension to have a similar file to the one that was downloaded from the email. The file referenced the website and, after displaying its properties, a version number, a description and a copyright could be seen. It propagated via email with the subject вЂњMelt the Heart of your Valentine with this beautiful Screen saverвЂќ which contained the attachment вЂњ Valentin.scrвЂќ.ДЄfter downloading the alleged screensaver, the user could see a desktop shortcut similar to the one on the image below.

#CUTE WRITER MALWARE WINDOWS#

The Yaha worm, also known as Lentin, was particularly infectious for Windows users during the years 20. Valentine's Day is one of the best examples of this which is why the malware analysis team of UNAM-CERT decided to publish a report about a sample that, although itвЂ™s not recent, illustrates very well the dangers of falling into the frauds of the creators of malicious code. During holidaysmalicious activity increases because the attackers are usually more successful in deceiving users and taking advantage.

Cute writer malware