WORM_GOLROTED.ABAFL

This worm arrives via removable drives. It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

Arrival Details

This worm arrives via removable drives.

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This worm drops the following copies of itself into the affected system and executes them:

• %Application Data%\Windows Update.exe

(Note: %Application Data% is the Application Data folder, where it usually is C:\Documents and Settings\{user name}\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Roaming on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

It drops the following files:

• %Application Data%\pid.txt
• %Application Data%\pidloc.txt
• %User Temp%\screens\screenshot{1, 2, 3, ...}.jpeg (takes screenshots every 10 minutes)

(Note: %Application Data% is the Application Data folder, where it usually is C:\Documents and Settings\{user name}\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Roaming on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.. %User Temp% is the user's temporary folder, where it usually is C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local\Temp on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

Autostart Technique

This worm adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Windows Update = "%Application Data%\Windows Update.exe"

Other System Modifications

This worm modifies the following registry entries:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
Hidden = 1

Propagation

This worm drops the following copy(ies) of itself in all removable drives:

• {Removable drive}:\Sys.exe

It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

The said .INF file contains the following strings:

[autorun]
open=Sys.exe
action=Run win32

Information Theft

This worm gathers the following data:

• Server Name
• Keyboard Logs
• Clipboard Logs
• Time Logs
• Stealers Enabled
• Local Date and Time
• Installed Language
• Operating System
• Internal IP Address
• External IP Address
• Installed Anti-Virus
• Installed Firewall

It attempts to steal stored email credentials from the following:

• Internet Account Manager
• Outlook Express
• Microsoft Outlook
• Windows Mail
• Windows Live Mail
• IncrediMail
• Eudora
• Netscape
• Mozilla Thunderbird
• Group Mail Free
• Yahoo! Mail
• Hotmail/MSN mail
• Gmail
• Google Desktop
• Google Talk

It attempts to get stored information such as user names, passwords, and hostnames from the following browsers:

• Internet Explorer
• Firefox
• Chrome
• Chrome SxS
• Opera
• Safari
• Seamonkey

Drop Points

This worm sends the information it gathers to the following email addresses:

• yoges@{BLOCKED}ping.com

Other Details

This worm connects to the following URL(s) to get the affected system's IP address:

• http://whatismyipaddress.com

NOTES:

This worm hides the files that it drops in removable drives.

It disables the following processes:

• taskmgr.exe
• cmd.exe
• msconfig.exe
• regedit.exe

It steals passwords from the following applications:

• Steam
• Minecraft