W32/Maslan is an email worm. The worm will infect Windows systems and spreads through email.

The infected email carries a spoofed 'From' address, picked up from the infected system.

The subject of the infected mail will be any one of the following:

123
12345

The body of the infected mail will be:

Hello <%Name%>,

--
Best regards,
<%Name%>                               <%email address%>

The infected email has any one of the following attachment:

PlayGirls2.exe
PlayGirls_2.exe

Upon execution of the infected attachment the worm copies itself as ___r.exe, ___synmgr.exe, ___n.exe in the Windows System Folder.

The worm modifies registry at the following location to run itself at the startup;

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices

To propagate itself, the worm scans the files having the following extensions and collects all the available email addresses from the infected system;

.xml, .xls, .asp, .adb,.dhtm, .dbx, .wsh, .wab, .uin, .txt, .tbb, .stm, .shtm, .sht, .php, .oft, .ods, .nch, .msg, .mmf, .mht, .mdx, .mbx, .jsp, .htm, .eml, .cgi, .cfg.

The worm emails itself to these addresses using its own SMTP engine.

The backdoor component of the worm drops an IRC backdoor which allows the remote user to perform a DoS (Denial of Service) attack and other illegal operations.

The worm also exploits the RPC DCOM Buffer Overflow (MS03-026) to remotely execute programs in vulnerable systems

The worm also tries to terminate antivirus and security related software.

This worm first appeared on 06th December, 2004.

Other names of W32/Maslan Worm:

This Worm is also known as WORM_MASLAN.A, W32/Maslan-C.