This worm spreads via the Internet as an atttachment to infected messages. It sends itself to all email addresses found on the victim computer.
The worm itself is a Windows PE EXE file. It is written in Visual Basic and is approximately 20KB in size.
Installation
Once launched, the worm causes the following window to be displayed:
When installing itself to the victim machine, the worm copies itself to the Windows root directory under the following names:
%WinDir%\crssr.exe
%WinDir%\raz32.exe
%WinDir%\tsunami.exe
It then registers itself in the system registry:
[HKLM\Software\Microsoft\Windows\CurrentVersion\Run]
"CaptionMgr32" = "%systemroot%\crssr.exe"
This ensures that a copy of the worm will be launched each time the victim machine is rebooted.
Propagation via email
The worm scans the MS Outlook address book for email addresses to send itself
to. The worm sends copies of itself using the mail client on the victim machine.
Infected messages
Message subject:
Tsunami Donation! Please help!
Message body:
Please help us with your donation and view the attachment below!
We need you!
Attachment name
tsunami.exe
Payload
Zar.a attempts to conduct a DoS attack on www.hacksector.de
Check out if we have free removal tool for this virus
