WORM_KELIHOS.NIS

This worm arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This worm arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Autostart Technique

This worm adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
{random parameter 1}{random parameter 2} = "{malware path and file name}"

Other System Modifications

This worm adds the following registry entries:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
DefaultCompressedRecord = "{random value}"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
RecordModifiedMax = "{random value}=="

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
FlagsModifiedValid = "0"

HKEY_CURRENT_USER\Software\TansuTCP
ActiveModifiedTheme = "{random value}"

HKEY_CURRENT_USER\Software\TansuTCP
SizeCompletedValid = "{random value}=="

HKEY_CURRENT_USER\Software\TansuTCP
InfoPlayedCurrent = "0"

Propagation

This worm drops the following copy(ies) of itself in all removable drives:

• {Removable Drive Letter}:\{random file name}.exe

Dropping Routine

This worm drops the following files:

• {Removable Drive Letter}:\{folder name}.lnk - if folder exists in removable drive
• {Removable Drive Letter}:\Shortcut to {random file name}.lnk

Other Details

This worm connects to the following possibly malicious URL:

• http://{BLOCKED}2.com/page_click.php

NOTES:

This worm modifies its file attributes to Read-only and Hidden after execution.

The auto-run registry {random parameter 1} can be any of the following:

• Network
• Time
• CrashReport
• Database
• Icon
• Desktop
• Tray
• Video
• Media

The auto-run registry {random parameter 2} can be any of the following:

• Checker
• Informer
• Notifyer
• Saver
• Updater
• Verifyer

The dropped copy {random file name} in removable drives can be any of the following:

• click
• game
• hentai
• installer
• password
• porn
• run
• sas
• screensaver

It drops shortcut files pointing to the copy of itself in removable drives. These dropped .LNK files use the names of the folders located on the said drives for their file names. It then sets the attributes of the original folders to Hidden to trick the user into clicking the .LNK files.

It connects to random generated IP addresses with the following URL path:

• /file.htm
• /online.htm
• /start.htm
• /install_login.htm
• /setup.htm
• /welcome.htm
• /search.htm
• /home.htm
• /default.htm
• /index.htm