WORM_LOLBOT.A

This worm arrives via removable drives. It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This worm arrives via removable drives.

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This worm drops the following copies of itself into the affected system and executes them:

• %Application Data%\HEX-5823-6893-6818\jutched.exe
• %System Root%\Public\HEX-5823-6893-6818\jutched.exe (for Windows 7 and Vista)

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.. %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.)

It drops the following files:

• {Drive Letter}:\{folder name}s.lnk - if the removable drive contains folders
• %System%\winrtsnr.txt

(Note: %System% is the Windows system folder, which is usually C:\Windows\System32.)

It creates the following folders:

• %Application Data%\HEX-5823-6893-6818
• %System Root%\Public\HEX-5823-6893-6818 (for Windows 7 and Vista)

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.. %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.)

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• l0lkn0lltr0ll

Autostart Technique

This worm adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Java Update Manager = "%Application Data%\HEX-5823-6893-6818\jutched.exe"

Other System Modifications

This worm creates the following registry entry(ies) to bypass Windows Firewall:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\AuthorizedApplications\
List
%Application Data%\HEX-5823-6893-6818\jutched.exe = "%Application Data%\HEX-5823-6893-6818\jutched.exe:*:Enabled:Java Update Manager"

Propagation

This worm creates the following folders in all removable drives:

• {Drive Letter}:\{random digit}

It drops the following copy(ies) of itself in all removable drives:

• {Drive Letter}:\{random digit}\{folder name}.exe

It sends the following messages using the aforementioned Instant Messaging applications:

mira esta fotografa :D {malware download link}
seen this?? :D {malware download link}
This is the funniest photo ever! {malware download link}
olhar para esta foto :D {malware download link}
Wie findest du das Foto? {malware download link}
se ps dette bildet :D {malware download link}
bekijk deze foto :D {malware download link}
poglej to fotografijo :D {malware download link}
pogledaj to slike :D {malware download link}
titta ps denna bild :D {malware download link}
pozrite sa na to fotografiu :D {malware download link}
uita-te la aceasta fotografie :D {malware download link}
katso tStS kuvaa :D {malware download link}
bu resmi bakmak :D {malware download link}
spojrzec na to zdjecie :D {malware download link}
nTzd meg a kTpet :D {malware download link}
ser ps dette billede :D {malware download link}
podfvejte se na mou fotku :D {malware download link}
guardare quest'immagine :D {malware download link}
regardez cette photo :D {malware download link}

It sends messages that contain links to sites hosting remote copies of itself using the following instant-messaging (IM) applications:

• Yahoo
• XFire
• Skype
• PalTalk
• ICQ
• GTalk
• MSN

Backdoor Routine

This worm opens the following port(s) where it listens for remote commands:

• 1866

It connects to any of the following IRC server(s):

• http://{BLOCKED}ution.nicaze.net

It accesses a remote Internet Relay Chat (IRC) server where it receives the following commands from a remote malicious user:

• Upload files
• Download and execute files

Information Theft

This worm gathers the following data:

• Host Name
• Locale Info
• OS Version

NOTES:
It drops shortcut files pointing to the copy of itself in removable drives. These dropped .LNK files use the names of the folders located on the said drives for their file names. It then sets the attributes of the original folders to Hidden to trick the user into clicking the .LNK files.