Threat Encyclopedia

This worm arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This worm arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This worm injects codes into the following process(es):

• IEXPLORE
• chrome
• firefox
• iexplore
• opera

Download Routine

This worm accesses the following websites to download files:

• http://www.{BLOCKED}arding.com/4721605860.txt

NOTES:

This worm terminates and deletes itself when the following conditions are met:

• If file name contains any of the following string:
  
  • malware
  • sample
  • sand-box
  • sandbox
  • test
  • virus
• If computer name of the affected system is any of the following:
  
  • DELL-D3E62F7E26
  • HOME-OFF-D5F0AC
  • KAKAPROU-6405DA
  • MAKKK
  • Malekal
  • VMG-CLIENT
• If user names found on the affected system are any of the following:
  
  • DELL-D3E62F7E26
  • HOME-OFF-D5F0AC
  • KAKAPROU-6405DA
  • klasnich
  • Mak
  • Malekal
  • VMG-CLIENT

This worm enumerates entries from the following registry and check for the following virtual environment:

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum
VMware
VBox
Virtual
QEMU

It checks if it running in a virtual environment by checking if any of the following files are running in memory:

• cports.exe
• dumpcap.exe
• filemon.exe
• procdump.exe
• procexp.exe
• procmon.exe
• regmon.exe
• regshot.exe
• sbiectrl.exe
• squid.exe
• syssafe.exe
• tcpview
• vbox
• vmsrvc
• vmware
• wireshark.exe

It also checks if opened windows or classes contain any of the following:

• CurrPorts*
• Microsoft Network Monitor 3.3
• Process Monitor - Sysinternals: www.sysinternals.com
• PROCEXPL
• Regshot 1.8.2
• SmartSniff
• TCPViewClass
• The Wireshark Network Analyzer

It also checks if the following files exist:

• %Program Files%\Ethereal\ethereal.html
• %Program Files%\Microsoft Network Monitor 3\netmon.exe
• %Program Files%\WinPcap\rpcapd.exe
• %Program Files%\WireShark\rawshark.exe

(Note: %Program Files% is the default Program Files folder, usually C:\Program Files.)

This worm monitors users' browsing activities such as message posting, deleting posted messages and private messages sent on the following websites:

• Facebook
• Meebo
• MySpace
• Twitter
• WordPress

It may spread by posting messages in the aforementioned sites. The messages posted may contain a URL that leads to its copy.