WORM_JOLEEE.YB

This worm arrives as an attachment to email messages spammed by other malware/grayware or malicious users. It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It may also compose messages that can be part of its spamming routine.

It executes commands from a remote malicious user, effectively compromising the affected system.

It also has rootkit capabilities, which enables it to hide its processes and files from the user.

It deletes itself after execution.

Arrival Details

This worm arrives as an attachment to email messages spammed by other malware/grayware or malicious users.

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This worm drops the following non-malicious files:

• %System%\drivers\str.sys
• %System%\MAI3.tmp

(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.)

It injects itself into the following processes running in the affected system's memory:

• svchost.exe
• explorer.exe

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• Global\{3D5A1694-CC2C-4ee7-A3D5-A879A9E3A62A}

Autostart Technique

This worm registers itself as a system service to ensure its automatic execution at every system startup by adding the following registry entries:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\{random}
ImagePath = "%System%\drivers\{random}.sys"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\{random}
DisplayName = "{random}"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\{random}
Group = "Boot Bus Extender"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\{random}
Type = "1"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\{random}
Start = "0"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\{random}
ErrorControl = "0"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\{random}
_MAIN = "\??\%System%\MAI3.tmp"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\{random}
RulesData = "{hex values}"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\{random}
krnl_sleepfreq = "{hex values}"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\{random}
krnl_servers_list = "{hex values}"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\{random}\Enum
Count = "0"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\{random}\Enum
NextInstance = "0"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\{random}\Enum
INITSTARTFAILED = "1"

It registers as a system service to ensure its automatic execution at every system startup by adding the following registry keys:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\{random}

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\{random}\Enum

Propagation

This worm may also compose messages that can be part of its spamming routine.

Backdoor Routine

This worm executes the following commands from a remote malicious user:

• perform DoS/DDoS attacks
• download files from a remote computer and/or the Internet
• run executable files
• terminate running processes
• sending various information about the infected computer
• update itself to a newer version
• receive data for spam email

It connects to the following URL(s) to send and receive commands from a remote malicious user:

• http://{BLOCKED}3.200/536/getcfg.php

Rootkit Capabilities

This worm also has rootkit capabilities, which enables it to hide its processes and files from the user.

Process Termination

This worm terminates the following processes if found running in the affected system's memory:

• AVGIDSAgent.exe
• AVGIDSMonitor.exe
• McSvHost.exe
• MsMpEng.exe
• Normandy.sys
• RkUnhooker.exe
• RootRepeal.exe
• avfwsvc.exe
• avgam.exe
• avgchsvx.exe
• avgcsrvx.exe
• avgemc.exe
• avgfrw.exe
• avgfws9.exe
• avgnsx.exe
• avgnt.exe
• avgrsx.exe
• avgtray.exe
• avguard.exe
• avgui.exe
• avgwdsvc.exe
• avmailc.exe
• avp.exe
• avshadow.exe
• avwebgrd.exe
• ccSvcHst.exe
• cfp.exe
• cmdagent.exe
• dwengine.exe
• egui.exe
• ekrn.exe
• gmer.exe
• gmer.sys
• greypill.sys
• kl1.sys
• mcagent.exe
• mcshield.exe
• mfefire.exe
• mfevtps.exe
• msseces.exe
• rootrepeal.sys
• spideragent.exe
• spidergate.exe
• spiderml.exe

Dropping Routine

This worm drops the following files:

• %System%\drivers\{random}.sys - detected as RTKT_JOLEEE.YB

(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.)

Other Details

This worm connects to the following possibly malicious URL:

• http://{BLOCKED}.73.200/536/getcfg.php

It deletes itself after execution.