Effects

ComWar.A carries out the following actions in cellphones running the operating system Symbian series 60:

    * If it is run within the first hour of the 14th of any month, it resets the cellphone.
    * It randomly displays any of the following messages:

      CommWarrior v1.0 © 2005 by e10d0r

      CommWarrior is freeware product. You may freely distribute it in it's original unmodified form.

      OTMOP03KAM HET!

Infection strategy

ComWar.A creates the following files when it is installed:

    * COMMWARRIOR.EXE and COMMREC.MDL in the directory C:\ SYSTEM\ APPS\ COMMWARRIOR.
    * COMMREC in the directory C:\ SYSTEM\ RECOGS.

Once it is run, ComWar.A creates the following files in the directory C:\SYSTEM\UPDATES:

    * COMMREC.MDL.
    * COMMWARRIOR.EXE.
    * COMMW.SIS.

Means of transmission

ComWar.A spreads via BlueTooth and through MMS messages.

Keep in mind that ComWar.A needs the user intervention in order to be run on the cellphone. Before the malicious file is installed, the user receives a security warning.



1.- Transmission via Bluetooth.

Bluetooth is a technology that allows to create wireless connections of electronic devices. ComWar.A follows the routine below in order to use this technology:

    * Once it has affected a device, ComWar.A starts searching for other devices with Bluetooth technology built-in, in order to spread to them.
    * ComWar.A sends a copy of itself with a random name to the Bluetooth devices it has found.
    * ComWar.A repeats this scheme once per minute.



2.- Transmission through MMS messages.

MMS (Multimedia Message Service) is a method of transmitting multimedia files, such as graphics, text messages, video clips, etc. over wireless networks, using the WAP protocol.

In order to spread using MMS messages, ComWar.A follows the routine below:

    *
      It reaches the cellphone in a message with variable characteristics:

      Message 1:
      Subject: Norton AntiVirus
      Message: Released now for mobile, install it!

      Message 2:
      Subject: Dr.Web
      Message: New Dr.Web antivirus for Symbian OS. Try it!

      Message 3:
      Subject: MatrixRemover
      Message: Matrix has you. Remove matrix!

      Message 4:
      Subject: 3DGame
      Message: 3DGame from me. It is FREE !

      Message 5:
      Subject: MS-DOS
      Message: MS-DOS emulator for SymbvianOS. Nokia series 60 only. Try it!

      Message 6:
      Subject: PocketPCemu
      Message: PocketPC *REAL* emulator for Symbvian OS! Nokia only.

      Message 7:
      Subject: Nokia ringtoner
      Message: Nokia RingtoneManager for all models.

      Message 8:
      Subject: Security update #12
      Message: Significant security update. See www.symbian.com

      Message 9:
      Subject: Display driver
      Message: Real True Color mobile display driver!

      Message 10:
      Subject: Audio driver
      Message: Live3D driver with polyphonic virtual speakers!

      Message 11:
      Subject: Symbian security update
      Message: See security news at www.symbian.com

      Message 12:
      Subject: SymbianOS update
      Message: OS service pack #1 from Symbian inc.

      Message 13:
      Subject: Happy Birthday!
      Message: Happy Birthday! It is present for you!

      Message 14:
      Subject: Free SEX!
      Message: Free *SEX* software for you!

      Message 15:
      Subject: Virtual SEX
      Message: Virtual SEX mobile engine from Russian hackers!

      Message 16:
      Subject: Porno images
      Message: Porno images collection with nice viewer!

      Message 17:
      Subject: Internet Accelerator
      Message: Internet accelerator, SSL security update #7.
     
      Message 18:
      Subject: WWW Cracker
      Message: Helps to *CRACK* WWW sites like hotmail.com

      Message 19:
      Subject: Internet Cracker
      Message: It is *EASY* to *CRACK* provider accounts!

      Message 20:
      Subject: PowerSave Inspector
      Message: Save you battery and *MONEY*!

      Message 21:
      Subject: 3DNow!
      Message: 3DNow!™ mobile emulator for *GAMES*.

      Message 22:
      Subject: Desktop manager
      Message: Official Symbian desctop manager.

      Message 23:
      Subject: CheckDisk
      Message: *FREE* CheckDisk for SymbianOS released!MobiComm, Mobile communications inspector. Try it!
    * All of these messages include a SIS file with a random name, which contains the code of ComWar.A.
    * Once it is installed and run, ComWar.A sends a copy of that SIS file to all the entries in the Address Book of the Symbian device.