Payload
Sends E-mail
When executed, Chopemail searches for e-mail addresses stored on the local system. It does this by opening each user's personal folder on the system. It opens this directory and then every sub-folder within this directory: (each sub-folder corresponds to a user of the system):
<Windows Drive>\Documents and settings\
Note: <Windows Drive> is usually C:\ (or which ever drive the Windows Operating system has been installed to).
E-mail addresses are written to the file %Windows%\s.txt
Note: '%Windows%' is a variable location. The trojan determines the location of the current Windows folder by querying the operating system. The default installation location for the Windows directory for Windows 2000 and NT is C:\Winnt; for 95,98 and ME is C:\Windows; and for XP is C:\Windows.
Chopemail creates the following 3 files in the %Windows% directory and uses them to perform MX lookups:
After this, it sends an e-mail to the user's mail-server. The e-mail are in HTML format. At the time of publishing, CA had received reports of two different variants in the wild. While each variant is very similar in function, the e-mail they send have a slightly different format:
E-mail sent by Win32.Chopemail.A:
From:
girl@worldgirls.com
Subject:
Re: hot pics
Body:
Hello, mate!
Just found this hot teen girl, if you want you can see here:
http://www.nude-teens-bodies.com/girl/
sweet body and hot tits!
reply me what you think about
The e-mail also contains a hidden IFrame which gets its content from the http://conyc.com/ domain. Please see an example of the e-mail below:
E-mail sent by Win32.Chopenoz.B:
From:
girl@bestearthgirls.com <girl@bestearthgirls.com>
Subject:
Re: hot pics
Body:
Hello, mate!
Just found this hot teen girl, if you want you can see here:
http://cn.to/troom
sweet body and hot tits!
reply me what you think about
The e-mail also contains a hidden IFrame which gets its content from the http://cn.to/troom domain.
We expect future variants to use a similar e-mail structure.
The link that the e-mail points to has been designed to exploit un-patched versions of Internet Explorer using multiple vulnerability exploits. If one of the attacks are successful the system is infected with a Win32.Chopenoz variant.
The embedded IFrame may also compromise unpatched machines, this is dependent on what content is given by the webserver (which obviously may be subject to change).
Deletes Files
Win32.Chopemail deletes C:\messanger.bak if it exists on an affected system. It then renames C:\messanger.ini to C:\messanger.bak.
Analysis by Paul Taylor
Back to top