WORM_OTORUN.MOT

This worm may be dropped by other malware.

It drops copies of itself into network drives.

Arrival Details

This worm may be dropped by the following malware:

• TROJ_SFXMOT.A

Installation

This worm drops the following copies of itself into the affected system:

• %Application Data%\Microsoft\IME\V2005\PHIME2002A.exe

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Windows\Profiles\{user name}\Application Data on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Application Data on Windows NT, and C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, XP, and Server 2003.)

It drops the following files:

• %User Temp%\rstimgr.inf

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003.)

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• 720110613
• 820110615

Autostart Technique

This worm adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
PHIME2002A.exe = %Application Data%\Microsoft\IME\V2005\PHIME2002A.exe

Propagation

This worm drops copies of itself into network drives.

Process Termination

This worm terminates the following processes if found running in the affected system's memory:

• wscript.exe
• autorun.exe

NOTES:

It executes the following files bundled with this malware:

• smcnmgr.exe - also detected by Trend Micro as WORM_OTORUN.MOT
• winmsgr.exe - detected by Trend Micro as TROJ_SFXMOT.A

It connects to the following URLS to download and execute other files:

• http://{base url}/bin/read_a.php?a1={some encrypted data}

where {base url} includes:

• {BLOCKED}raze.crabdance.com
• {BLOCKED}hecker.myftp.biz
• {BLOCKED}ree.freebyte.us
• {BLOCKED}apa.noads.biz
• {BLOCKED}ara.freeoda.com
• {BLOCKED}oro.ueuo.com
• {BLOCKED}aba.net84.net
• {BLOCKED}hile.00free.net
• {BLOCKED}ara.oliwy.net
• {BLOCKED}hop.hostmefree.org

The encrypted data in the URL contains the following information:

• Adapter Information
• Computer Name
• Operating System
• Processor Name
• User Name

It does not continue its execution when the following process exists:

• RsAgent.exe

It also checks if the malware runs under a virtual machine by checking the following from the obtained system information:

• QEMU
• VMWARE

Propagation Routine

It copies the contents of rstimgr.inf and names the file as autorun.inf in network drives. It contains the following strings:

[autorun]
icon=%SystemRoot%\system32\SHELL32.dll,8
ACTION=Windows Explorer to view files
shellexecute= autorun.exe

This automatically executes autorun.EXE when the network drive is accessed.