Blaster (Lovsan) Worm Technical Intelligence Dossier

Executive Summary & Threat Architecture

Blaster (also widely cataloged as MSBlast, Lovsan, and Poosan) is one of the most famous and destructive self-propagating computer worms in internet history, first detected on August 11, 2003. Propagating at machine speed across the global IPv4 address space without requiring any email opening, attachment execution, or user interaction, Blaster scanned random IP subnets on TCP port 135 to find unpatched endpoints running Microsoft Windows 2000 and Windows XP. When an open port was found, Blaster exploited a critical stack buffer overflow in the Distributed Component Object Model (DCOM) interface of the Windows RPCSS service (CVE-2003-0352 / MS03-026). Once code execution was achieved, Blaster spawned an unauthenticated remote command shell on TCP port 4444 and instructed the compromised endpoint to download the full worm binary ('msblast.exe') from the attacking host via Trivial File Transfer Protocol (TFTP) over UDP port 69. The worm payload contained hidden text strings taunting Microsoft's founder ('billy gates why do you make this possible ? Stop making money and fix your software!!'). Additionally, Blaster was programmed to launch a coordinated distributed denial-of-service (DDoS) SYN flood against port 80 of windowsupdate.com starting on August 15, 2003, forcing Microsoft to temporarily take the Windows Update portal offline to protect global internet routing infrastructure. Blaster infected hundreds of thousands of computers worldwide within days, severely degrading internet traffic and accelerating the creation of modern Windows security baselines.

Observed Threat Aliases: MSBlast, Lovsan, Poosan, W32.Blaster.Worm, Win32/Blaster

Ancestry & Lineage Tracking

Derived From / Upstream Ancestry: Proprietary origin

Documented Downstream Variants: blaster_a, blaster_b, welchia_nachi_counterworm

Weaponized Vulnerabilities & Exploitation Topology

Documented common vulnerabilities and exposures (CVEs) weaponized by Blaster (Lovsan) Worm operators for initial execution, sandbox evasion, or SYSTEM-level kernel privilege escalation:

→ Explore all 77 exploited vulnerabilities on the SystemHelpDesk CVE Threat Matrix Hub.

MITRE ATT&CK® Tactical Tradecraft

Tactics, techniques, and procedures (TTPs) systematically mapped across real-world intrusion kill-chains:

→ Inspect the complete 226-technique matrix on the MITRE ATT&CK Defense Hub.

Indicators of Compromise (IOCs) & Forensic Artifacts

Curated indicators for retrospective threat hunting across SIEM and EDR platforms:

Initial Delivery Vectors

• Autonomous network worm propagation exploiting DCOM RPC buffer overflow CVE-2003-0352 over TCP port 135
• Automated TFTP download on UDP port 69 spawning command shell on TCP port 4444

Host Persistence & Execution Hooks

• HKLM\Software\Microsoft\Windows\CurrentVersion\Run entry pointing to msblast.exe in %SYSTEM32%
• Spawning of autonomous background scanning threads on system boot

Reference File Hashes (SHA-256)

• 2b6a5db21d00f7e44a42e5d7db69b466ea2084c55bc66c5d1e2e1329c31b312b
• a17387f5df2307ef086915091219b671a172776c59b67195721118182969b761