VBS_DUNIHI.IXG

This worm arrives via removable drives. It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It drops copies of itself in all removable drives.

It executes commands from a remote malicious user, effectively compromising the affected system. It connects to a website to send and receive information.

Arrival Details

This worm arrives via removable drives.

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This worm drops the following copies of itself into the affected system:

• %User Temp%{malware filename}.vbs

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.)

Autostart Technique

This worm adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
{malware filename} = "wscript.exe//B"%User Temp%{malware filename}.vbs""

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Run
{malware filename} = "wscript.exe//B"%User Temp%{malware filename}.vbs""

It drops the following file(s) in the Windows User Startup folder to enable its automatic execution at every system startup:

• %User Startup%\{malware filename}.vbs

(Note: %User Startup% is the current user's Startup folder, which is usually C:\Windows\Profiles\{user name}\Start Menu\Programs\Startup on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Start Menu\Programs\Startup on Windows NT, and C:\Documents and Settings\{User name}\Start Menu\Programs\Startup.)

Propagation

This worm drops the following copy(ies) of itself in all removable drives:

• {Removable Drive Letter}:\{malware filename}.vbs

It drops copies of itself in all removable drives.

Backdoor Routine

This worm executes the following commands from a remote malicious user:

• Execute files
• Update itself
• Uninstall itself
• Donwnload files
• Upload files
• Enumerate drivers
• Enumerate files and folders
• Enumerate processes
• Perform remote shell
• Delete files and folders
• Terminate process
• Sleep

It connects to the following websites to send and receive information:

• http://{BLOCKED}u.ddnsking.com:200/is-ready

Information Theft

This worm gathers the following data:

• Computer name
• Host name
• OS Version

NOTES:

It drops the following shortcut pointing to its copy in all removable drive:

• {Removable Drive Letter}:\{user files}.lnk - detected as LNK_DUNIHI.SMIX

This worm creates .LNK (shortcut) files using folder or file names found in removable drives. It then hides the original folder/file tricking users to click .LNK files. This .LNK files point out to a dropped copy of itself in the removable drive.