WORM_YUNSIP.SMR

This worm arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes commands from a remote malicious user, effectively compromising the affected system. It connects to a website to send and receive information.

It logs a user's keystrokes to steal information.

Arrival Details

This worm arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This worm drops the following copies of itself into the affected system:

• %Windows%\Comres.dll
• %Windows%\usp10.dll

(Note: %Windows% is the Windows folder, which is usually C:\Windows or C:\WINNT.)

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• qq2009.3322.org

Autostart Technique

This worm modifies the following registry entries to ensure it automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\{Random Service}\Parameters
ServiceDll = "{malware path and file name}"

(Note: The default value data of the said registry entry is {original data from ServiceDll}.)

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\{Random Service}\Parameters
SvcMain = "{original data from ServiceMain}"

(Note: The default value data of the said registry entry is {original data from ServiceMain}.)

Other System Modifications

This worm adds the following registry entries as part of its installation routine:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\{Random Service}\Parameters
InstallPath = "{malware path and file name}"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\Session Manager
ExcludeFromKnownDlls = "usp10.dll"

Backdoor Routine

This worm executes the following commands from a remote malicious user:

• Log keystrokes
• Download updated copies of itself
• Download and upload files
• Deletes file
• Create and terminate processes

It connects to the following websites to send and receive information:

• qq2009.{BLOCKED}2.org

Information Theft

This worm logs a user's keystrokes to steal information.

Stolen Information

This worm saves the stolen information in the following file:

• {malware path}\log.sc

NOTES:

This worm drops copies of itself in all folders on fixed drives and removable drives containing .EXE files. This allows this worm to be loaded when an .EXE file attempts to load the legitimate USP10.DLL. This happens when an .EXE file loads DLL components from the same folder before checking in the system folders for the component DLL.

This worm also adds garbage strings in the dropped copies to avoid easy detection.

It connects to a site using port 1024.