Welcome to the Computer Security Wiki! You can help us by expanding stubs, create new articles and improve current articles.
You can also help us by logging-in or creating an account!

Logic

From Malware Wiki
Jump to: navigation, search


Logic
Image {{{image}}}
Type Worm
Creator Gigabyte
Date
Origin Mechelen, Belgium
Programming Language Logo
Platform Microsoft Windows
Filetype .LGP
Alias(es) Email-Worm.VBS.Logic
Impact {{{length}}}
Size {{{size}}}
Damage costs {{{cost}}}
MD5 {{{md5}}}
SHA1 {{{sha1}}}
CRC32 {{{crc32}}}
SHA256 {{{sha256}}}
SSDEEP {{{ssdeep}}}
Authentihash {{{authenti}}}
IMPhash {{{imp}}}
Vhash {{{ssdeep}}}

Email-Worm.VBS.Logic or Logic is an email worm that spreads as a .LGP (logo project) file. This is a very uncommon file extension for worms.

Behavior

Logic is the first known Internet-worm written in the Logo language. The worm itself is an LGP file, and it can only be executed with special interpreter software like SuperLogo for Windows.

The worm doesn't spread by itself; rather it drops two different components:

  • a VBS file to spread through e-mail a la LoveLetter
  • an INI file to spread through IRC channels

It also drops a BAT file that writes a message on the screen during Windows startup:

You think Logo worms don't exist? Think again!

The worm creates a VBS file in a Windows startup folder. Thus, it will be executed automatically upon the next Windows startup. The scripts in the VBS file create and send a message via Outlook to every entry in the address book.

Hey friends!
Hello! Look at my new SuperLogo program! Isn't it cool?
Attachment: logic.lgp

An MIRC script in the worm's INI file is very short, and just sends the worm's LGP file to all users joining an infected channel.