ALIASES:

Worm:Win32/Gamarue.F (Microsoft)

 PLATFORM:

Windows

 OVERALL RISK RATING:
 DAMAGE POTENTIAL:
 DISTRIBUTION POTENTIAL:
 REPORTED INFECTION:
 INFORMATION EXPOSURE:

  • Threat Type: Worm

  • Destructiveness: No

  • Encrypted: Yes

  • In the wild: Yes

  OVERVIEW

This worm arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes commands from a remote malicious user, effectively compromising the affected system. It connects to a website to send and receive information.

It modifies the Internet Explorer Zone Settings.

However, as of this writing, the said sites are inaccessible.

  TECHNICAL DETAILS

File Size: 246,784 bytes
File Type: EXE
Memory Resident: Yes
Initial Samples Received Date: 22 Dec 2014

Arrival Details

This worm arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This worm drops the following files:

  • {removable drive}:\Thumbs.db - WORM_ENCMARUE.SM
  • {removable drive}:\{random}.ini - WORM_GAMARUE.SMF
  • {removable drive}:\desktop.ini - encrypted component file. once decrypted, it decrypts Thumbs.db and saves it as %System Root%\Temp\TrustedInstaller.exe
  • {removable drive}:\{drive name} ({drive size}).LNK

It drops the following component file(s):

  • %User Temp%\{random filename}.{extension name} - WORM_GAMARUE.WE
    where {extension name} can be any of the following:
    • BAT
    • CMD
    • COM
    • EXE
    • PIF
    • SCR

(Note: %User Temp% is the user's temporary folder, where it usually is C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local\Temp on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

It adds the following processes:

  • wuauclt.exe

It injects itself into the following processes as part of its memory residency routine:

  • wuauclt.exe

Autostart Technique

This worm adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\policies\
Explorer\Run
{random number} = "%User Temp%\{random filename}.{extension name}"

Other System Modifications

This worm modifies the following registry entries to hide files with Hidden attributes:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
ShowSuperHidden = "0"

(Note: The default value data of the said registry entry is "1".)

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
Hidden = "2"

(Note: The default value data of the said registry entry is "1".)

Propagation

This worm creates the following folders in all removable drives:

  • {removable drive}:\{Non-breaking space character} - hidden folder containing user's original files and folders

Backdoor Routine

This worm executes the following commands from a remote malicious user:

  • Download a file from C&C server
  • Start a process
  • Uninstall itself
  • Remote command prompt

It connects to the following websites to send and receive information:

  • http://{BLOCKED}hed.ru/static.php
  • http://{BLOCKED}nsreiuojy.ru/2ldr.php
  • http://{BLOCKED}reiuojy.ru/3ldr.php
  • http://{BLOCKED}eiuojy.ru/41ldr.php
  • http://{BLOCKED}reiuojy.ru/51ldr.php
  • http://{BLOCKED}eiuojy.ru/6ldr.php

Web Browser Home Page and Search Page Modification

This worm modifies the Internet Explorer Zone Settings.

Download Routine

This worm accesses the following websites to download files:

  • http://a.{BLOCKED}taheavy.ru/a?={value}
  • http://b.{BLOCKED}taheavy.ru/b?={value}
  • http://c.{BLOCKED}taheavy.ru/c?={value}

Other Details

This worm connects to the following URL(s) to check for an Internet connection:

  • www.update.microsoft.com

However, as of this writing, the said sites are inaccessible.

NOTES:

This worm moves the user's original files and folders to a hidden folder

It sets the attribute of all files and folders in removable drives to Hidden.

  SOLUTION

Minimum Scan Engine: 9.700
FIRST VSAPI PATTERN FILE: 11.362.03
FIRST VSAPI PATTERN DATE: 22 Dec 2014
VSAPI OPR PATTERN File: 11.363.00
VSAPI OPR PATTERN Date: 23 Dec 2014

Step 1

Before doing any scans, Windows XP, Windows Vista, and Windows 7 users must disable System Restore to allow full scanning of their computers.

Step 2

Note that not all files, folders, and registry keys and entries are installed on your computer during this malware's/spyware's/grayware's execution. This may be due to incomplete installation or other operating system conditions. If you do not find the same files/folders/registry information, please proceed to the next step.

Step 3

Remove the malware/grayware file dropped/downloaded by WORM_GAMARUE.WE. (Note: Please skip this step if the threat(s) listed below have already been removed.)

     
    • WORM_GAMARUE.SMF
    • WORM_ENCMARUE.SM

Step 4

Scan your computer with your Trend Micro product and note files detected as WORM_GAMARUE.WE

Step 5

Restart in Safe Mode

[ Learn More ]

Step 6

Delete this registry value

[ Learn More ]

Important: Editing the Windows Registry incorrectly can lead to irreversible system malfunction. Please do this step only if you know how or you can ask assistance from your system administrator. Else, check this Microsoft article first before modifying your computer's registry.

  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run
    • {random number} = "%User Temp%\{random filename}.{extension name}"

Step 7

Restore this modified registry value

[ Learn More ]

Important: Editing the Windows Registry incorrectly can lead to irreversible system malfunction. Please do this step only if you know how or you can ask assistance from your system administrator. Else, check this Microsoft article first before modifying your computer's registry.

  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
    • From: ShowSuperHidden = "0"
      To: ShowSuperHidden = "1"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
    • From: Hidden = "2"
      To: Hidden = "1"

Step 8

Search and delete this file

[ Learn More ]
There may be some files that are hidden. Please make sure you check the Search Hidden Files and Folders checkbox in the "More advanced options" option to include all hidden files and folders in the search result.
  • {removable drive}:\desktop.ini
  • {removable drive} ({drive size}).LNK

Step 9

Restart in normal mode and scan your computer with your Trend Micro product for files detected as WORM_GAMARUE.WE. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check this Knowledge Base page for more information.

NOTES:

  • Unhide the folder {removable drive}:\{Non-breaking space character} by changing the attribute
  • Open a command prompt.

    For Windows 2000, Windows XP, and Windows Server 2003 users, click Start>Run. In the Search box, type CMD then press Enter.
    For Windows Vista, Windows 7, and Windows Server 2008 users, click Start, type CMD in the Search input field then press Enter.
    For Windows 8, Windows 8.1, and Windows Server 2012 users, right-click on the lower-left corner of the screen, click Command Prompt.
    In the CMD console, type the following:


    ATTRIB [+R | -R] [+A | -A ] [+S | -S] [+H | -H] [+I | -I] [drive:][path][file name] [/S [/D] [/L]]

    Where: + Sets an attribute.
    - Clears an attribute
    R Read-only file attribute
    A Archive file attribute
    S System file attribute
    H Hidden file attribute
    I Not content indexed file attribute
    [drive:][path][filename]
    Specifies a file or files for attrib to process
    /S Processes matching files in the current folder and all subfolders.
    /D Processes folders
    /L Work on the attributes of the Symbolic Link versus the target of the Symbolic Link

    Example: To unhide all files and folders (including subfolders) in drive D:
    ATTRIB –H D:\* /S /D
    Repeat Step 3 for folders and files in other drives or folders.

  • Copy all original files and folder inside the folder {removable drive}:\{Non-breaking space character} to user's desired location
  • Delete the folder {removable drive}:\{Non-breaking space character}


Did this description help? Tell us how we did.