JAVA_LOOBNUR.B

This worm arrives via removable drives. It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It opens random ports.

Arrival Details

This worm arrives via removable drives.

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This worm drops the following files:

• %User Temp%\hsperfdata_{username}\{random filename}.{random file extension} - detected as TROJ_BEYOND.B
• %User Temp%\hsperfdata_{username}\{random number}

It drops and executes the following files:

• %User Temp%\jar_cache{random number}.tmp - also detected as JAVA_LOOBNUR.B

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.)

It drops the following non-malicious files:

• %User Temp%\hsperfdata_{username}\{system filename}.exe - Normal Java File

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.)

It creates the following folders:

• %User Temp%\hsperfdata_{username}

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.)

Other System Modifications

This worm adds the following registry entries as part of its installation routine:

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\Active Setup\Installed Components\
{CLSID}
StubPath = ""cMd.ExE /Q /c START "" /i /b JAvAw.exE -classpath "%User Temp%\jar_cache{random number}" a"

Propagation

This worm drops the following copy(ies) of itself in all removable drives:

• {removable drive letter}:\RECYCLER\{SID}\{random filename}.{random file extension}

Backdoor Routine

This worm opens a random port to allow a remote user to connect to the affected system. Once a successful connection is established, the remote user executes commands on the affected system.

Other Details

This worm connects to the following URL(s) to check for an Internet connection:

• thepiratebay.org
• msn.com
• bing.com
• alibaba.com
• paypal.com
• photobucket.com
• imageshack.us
• youporn.com
• go.com
• xhamster.com
• blogspot.com
• hotfile.com
• facebook.com
• live.com
• megaupload.com
• doubleclick.com
• apple.com
• google.com
• livejasmin.com
• adobe.com
• megavideo.com
• myspace.com
• mediafire.com
• bbc.co.uk
• amazon.com
• godaddy.com
• yieldmanager.com
• nytimes.com
• 4shared.com
• wordpress.com
• linkedin.com
• cnet.com
• conduit.com
• rapidshare.com
• about.com
• orkut.com
• microsoft.com
• craigslist.org
• flickr.com
• livejournal.com
• pornhub.com
• mozilla.com
• tube8.com
• wikipedia.org
• twitter.com
• aol.com
• cnn.com
• tumblr.com
• ebay.com
• yahoo.com
• youtube.com
• ask.com
• xvideos.com
• imdb.com