Worm.Win32.IPPEDO.AB

This Worm arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It deletes registry entries, causing some applications and programs to not function properly.

Arrival Details

This Worm arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Worm drops the following copies of itself into the affected system:

• %System Root%\Google\{Malware Name}
• {Drive}\Skypee\{Malware Name}

(Note: %System Root% is the Windows root folder, where it usually is C:\ on all Windows operating system versions.)

It drops the following files:

• %System Root%\Google\Windowsupdate.lnk
• %System Root%\Google\GoogleUpdate.lnk

(Note: %System Root% is the Windows root folder, where it usually is C:\ on all Windows operating system versions.)

It adds the following processes:

• %comspec /c SystemInfo → when executed in Windows 7 or Windows XP

It creates the following folders:

• %System Root%\Google
• {Drive}\Skypee

(Note: %System Root% is the Windows root folder, where it usually is C:\ on all Windows operating system versions.)

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• googleupdate

It terminates itself if it finds the following processes in the affected system's memory:

• combination of the following processes
  • avp.exe, zonealarm.exe, and avguard.exe
  • tcpview.exe, procmon.exe, and nod32kui.exe
  • kavmm.exe, procmon.exe, and fsbwsys.exe
  • vmacthlp.exe, avp.exe, and kavsvc.exe
• VBoxService.exe
• VBoxTray.exe
• guninraik.exe
• SbieSvc.exe
• VMwareTray.exe
• VMwareUser.exe
• VMwareService.exe
• VMwareUser.exe
• FortiTracer.exe
• vmacthlp.exe
• vmtoolsd.exe
• BehaviorDumper.exe
• FakeHTTPServer.exe
• FakeServer.exe

Autostart Technique

This Worm adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Run
Windows Update = %System Root%\Google\Windowsupdate.lnk

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Windows Update = %System Root%\Google\Windowsupdate.lnk

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Run
JavaUpdate = %System Root%\Google\GoogleUpdate.lnk

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
AdopeUpdate = %System Root%\Google\GoogleUpdate.lnk

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Run
NewJavaInstall = %System Root%\Google\{Malware Name}

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
AdopeFlash = %System Root%\Google\{Malware Name}

It drops the following file(s) in the Windows Startup folder to enable its automatic execution at every system startup:

• Windowsupdate.lnk
• GoogleUpdate.lnk

It drops the following file(s) in the Startup Items folder to enable its automatic execution at every system startup:

• Windows Update.lnk

Other System Modifications

This Worm deletes the following files:

• googleupdate.vbs

It modifies the following registry entries:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
ShowSuperHidden = “0”

(Note: The default value data of the said registry entry is The default value data of the said registry entry is {User Preference}.)

It deletes the following registry entries:

HKEY_CLASSES_ROOT\lnkfile
IsShortcut =

Propagation

This Worm creates the following folder in all physical and removable drives:

• {Drive}\Skypee

Backdoor Routine

This Worm connects to the following URL(s) to send and receive commands from a remote malicious user:

• colaa.{BLOCKED}tp.com:2015

Information Theft

This Worm gathers the following data:

• Malware ID
• Computer Home Drive
• Computer Name
• Username
• OS Version
• OS Architecture
• Webcam Info("Yes" or "No")
• Malware Version
• Installed AV software
• Active Window Title

Other Details

This Worm does the following:

• It terminates itself if system information contains the following strings:
  • Bochs
  • innotek
  • VMware
• It terminates itself if the following folders are present:
  • C:\CWSandbox
  • C:\python26
  • C:\cuckoo
• It terminates itself if the malware is executed in the following directories:
  • C:\virus
  • C:\
• It terminates itself if malware name meets the following conditions:
  • contains "artifact" string
  • contains "sample" string
  • Malware Filename does not contain "."
  • Malware Filename length exceeds 35
  • Malware Filename starts with 7 or more numbers
• It terminates itself if the following process is not present:
  • explorer.exe
• Drops copy of the files and folders in malware path to the following folder:
  • {Drive}\Skypee
• It creates the following shortcut (.LNK) files in removable drives that points to its copy:
  • My Games
  • My Pictuers
  • My Videos
  • Hot
  • Downloads
  • Movies
  • Skypee\Skypee
• It also creates shortcut (.LNK) files using folder names as its filename in folders in all of the drives that points to its copy.

It terminates itself if any of the following file(s) are present:

• snxhk.dll
• tracer.dll
• SbieDll.dll
• api_log.dll
• dir_watch.dll
• dbghelp.dll
• monitornet.dll
• cuckoo
• SandCastle
• sandbox

It accesses the following URL(s) to get the affected system's location:

• http://www.geoplugin.net/json.gp