WORM_GOLROTED.SMV1

This worm arrives via removable drives. It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

Arrival Details

This worm arrives via removable drives.

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This worm drops the following copies of itself into the affected system and executes them:

• %Application Data%\Windows Update.exe

(Note: %Application Data% is the Application Data folder, where it usually is C:\Documents and Settings\{user name}\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Roaming on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

It drops the following files:

• %Application Data%\pid.txt
• %Application Data%\pidloc.txt
• %User Temp%\SysInfo.txt
• %User Temp%\screens\screenshot1.jpeg

(Note: %Application Data% is the Application Data folder, where it usually is C:\Documents and Settings\{user name}\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Roaming on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.. %User Temp% is the user's temporary folder, where it usually is C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local\Temp on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

It drops the following copies of itself into the affected system:

• %Application Data%\WindowsUpdate.exe

(Note: %Application Data% is the Application Data folder, where it usually is C:\Documents and Settings\{user name}\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Roaming on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

Propagation

This worm drops the following copy(ies) of itself in all removable drives:

• {Removable Drive Letter}:\Sys.exe

It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

The said .INF file contains the following strings:

[autorun]
open=Sys.exe
action=Run win32

Information Theft

This worm gathers the following data:

• Malware process ID
• Malware path
• Original malware path
• Host name
• Screenshots
• Keyboard Logs
• Clipboard Logs
• System Time
• Internal Language
• Operating System
• Internal IP
• External IP
• Antivirus installed
• Firewall Installed
• Current Active Window

Other Details

This worm connects to the following URL(s) to get the affected system's IP address:

• whatismyipaddress.com

NOTES:

This worm access the following Simple Mail Transfer Protocol (SMTP) servers in preparation to send its stolen information:

• smtp.mail.ru

It steals passwords from the following:

• Browsers
• Messaging applications
• Internet Download Manager
• Jdownloader
• Minecraft

It steals passwords from the following messaging applications:

• Microsoft Outlook
• Mozilla Thunderbird
• IncrediMail
• FoxMail
• Google Talk
• Gmail Notifier
• MSN Messenger
• Windows Live Mail
• Pidgin Messenger
• Miranda IM

It steals passwords from the following browsers:

• Firefox
• Internet Explorer
• Chrome
• Chrome S x S
• CoolNovo
• Opera
• Apple Safari
• Flock
• SeaMonkey
• SRWare Iron
• Comodo Dragon

It disables the following processes:

• taskmgr.exe
• regedit.exe
• msconfig.exe
• cmd.exe

It may come bundled with other files, and may show different behaviors such as:

• Search for CD keys, product keys, and serial numbers of the following applications:
  • Advanced PDF Password Recovery
  • Ashampoo WinOptimizer Platinum 3
  • Call of Duty
  • Camtasia Studio
  • Codec Tweak Tool
  • Command and Conquer Generals Zero Hour
  • Counter-Strike
  • CyberLink PowerDVD
  • Dawn of War
  • Empire Earth II
  • F-Secure BackWeb
  • Macromedia Flash
  • Nero
  • Network Associates, Inc. Sniffer Pro
  • PowerQuest PartitionMagic
  • Splinter Cell Pandora Tomorrow
  • Star Wars battlefront II
  • The Sims 2
  • TuneUp Utilities