Worm.Win32.GAMARUE.AA

This Worm arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This Worm arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Worm drops the following files:

• %User Temp%\smd{random chars}.tmp <- detected as BKDR_ANDROM.SMSW
• %Application Data%\ee{random chars}.exe <- detected as BKDR_ANDROM.SMSW
• %Common Startup%\{random char}.lnk <- lnk file pointing to %Application Data%\ee{random chars}.exe

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, and 8.. %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, and 8.. %Common Startup% is the startup folder for all users, which is usually C:\Documents and Settings\All Users\Start Menu\Programs\Startup on Windows 2000, XP, and Server 2003, or C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup on Windows Vista, 7, and 8.)

Other Details

This Worm requires the following additional components to properly run:

• "gQcguUzoRCdagyocywmdyx"

It requires the existence of the following files to properly run:

• IndexerVolumeGuid

It does the following:

• It consists of the following export calls:
  

   RffPvWfhKkrjMYcx - loads cursor from file "CudaceLeeEXOtg"
       - sets window text to "BCoGRmXMgAmSusC"
       - checks for the mutex: "mqbsjafmfusqlvzmqbsjafmfusqlvz"
       - loads functions from another exe/dll named "gQcguUzoRCdagyocywmdyx"
  

   jmweczbxcvjsi - checks and decrypts content of IndexerVolumeGuid
      - creates device context with name "kiqjIQahknR"
      - creates job object "ljlcfbjnmavs"
      - checks windows with name "APULEwHjrSSTSn"
  

   migjtsuukjvt - function used for character case conversion
  

   pzvmkcouyvqk - function used for flagging
  

   vyhbiozzrw - sets enviroment variable to "bLyvhIsMwur" / "obj"
      - creates a temporary file with the prefix string "SmdormAGjie"
  

   zjjcrmbehoakm - function used for buffer memory allocation