P2P-Worm.Win32.Relmony.a

Technical Details

Relmony is an Internet worm that spreads in the Kazaa and Morpheus peer-to-peer file exchange networks. The Relmony worm replicates by copying itself into the "shared folders" on victim client machines which comprise these networks.

The Relmony worm is a Windows application (PE EXE file) about 29KB in size. It is written in Visual Basic.

Installation
Relmony copies itself to the Windows auto-startup directories with the following names (shown at the end of each string):

C:\WINNT\system32\config\systemprofile\StartMenu\Programs\Startup\system.exe
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\system.exe
C:\WINDOWS\Start Menu\Programs\Startup\system.exe

Replication
Relmony copies itself to P2P directories under the following names:

Note 1 - there is a typo for the spelling of the Morpheus network name

C:\Program Files\KaZaA\My Shared Folder\free_hot_porn_for_sale_pussy_hot-sex-butt-black-young-kiddy-music-movie-sum-of-fears.exe
C:\Program Files\KaZaA\My Shared Folder\free_hot_porn_for_sale_pussy_hot-sex-butt-black-young-kiddy-music-movie-sum-of-fears_3.exe
C:\Program Files\KaZaA\My Shared Folder\free_hot_porn_for_sale_pussy_hot-sex-butt-black-young-kiddy-music-movie-sum-of-fears_.exe
C:\Program Files\KaZaA\My Shared Folder\free_hot_porn_for_sale_pussy_hot-sex-butt-black-young-kiddy-music-movie-sum-of-fears_4.exe
C:\Program Files\Morpeus\My SharedFolder\free_hot_porn_for_sale_pussy_hot-sex-butt-black-young-kiddy-music-movie-sum-of-fears.exe
C:\Program Files\Morpeus\My Shared Folder\free_hot_porn_for_sale_pussy_hot-sex-butt-black-young-kiddy-music-movie-sum-of-fears_2.exe
C:\Program Files\Morpeus\My Shared Folder\free_hot_porn_for_sale_pussy_hot-sex-butt-black-young-kiddy-music-movie-sum-of-fears_.exe
C:\Program Files\Morpeus\My Shared Folder\free_hot_porn_for_sale_pussy_hot-sex-butt-black-young-kiddy-music-movie-sum-of-fears_4.exe

Other
After being installed the Relmony worm creates a window with the following text appearing:

This window slowly moves from the top-left desktop corner to the bottom-right.

***Clicking on this window and the worm runs the join.php script from the http://www.ignifuge.com/getpaid server.

The Relmony worm then creates a small blue button in top left desktop corner with the word Money written on it. ***Clicking on this button runs the same PHP-script (join.php> from the same server.

The button - Money