Worm.Win32.YAHOS.AB

This Worm arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes commands from a remote malicious user, effectively compromising the affected system. It connects to a website to send and receive information.

Arrival Details

This Worm arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Worm adds the following folders:

• %Windows%\M-5050453680240545040250450525
• {Removable or Network Drive}\_

(Note: %Windows% is the Windows folder, where it usually is C:\Windows on all Windows operating system versions.)

It drops the following copies of itself into the affected system:

• %Windows%\M-5050453680240545040250450525\winmgr.exe
• {Removable or Network Drive}\Device Manager.exe

(Note: %Windows% is the Windows folder, where it usually is C:\Windows on all Windows operating system versions.)

It drops the following files:

• %Application Data%\winmgr.txt
• {Removable or Network Drive}\autorun.inf
• {Removable or Network Drive}\.lnk or {Removable or Network Drive}\USB DRIVE.lnk

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It adds the following processes:

• %Windows%\M-5050453680240545040250450525\winmgr.exe
• %Program Files%\Internet Explorer\iexplore.exe
• {Malware Path}\{Malware Filename}.exe

(Note: %Windows% is the Windows folder, where it usually is C:\Windows on all Windows operating system versions.. %Program Files% is the default Program Files folder, usually C:\Program Files in Windows 2000(32-bit), Server 2003(32-bit), XP, Vista(64-bit), 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit) , or C:\Program Files (x86) in Windows XP(64-bit), Vista(64-bit), 7(64-bit), 8(64-bit), 8.1(64-bit), 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• qazwsxedc
• t48

It injects codes into the following process(es):

• {Malware Path}\{Malware Filename}.exe
• %Program Files%\Internet Explorer\iexplore.exe

(Note: %Program Files% is the default Program Files folder, usually C:\Program Files in Windows 2000(32-bit), Server 2003(32-bit), XP, Vista(64-bit), 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit) , or C:\Program Files (x86) in Windows XP(64-bit), Vista(64-bit), 7(64-bit), 8(64-bit), 8.1(64-bit), 2008(64-bit), 2012(64-bit) and 10(64-bit).)

Autostart Technique

This Worm adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Microsoft Windows Manager = %Windows%\M-5050453680240545040250450525\winmgr.exe

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Microsoft Windows Manager = %Windows%\M-5050453680240545040250450525\winmgr.exe

Other System Modifications

This Worm adds the following registry entries:

It creates the following registry entry(ies) to bypass Windows Firewall:

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\AuthorizedApplications\
List
%Windows%\M-5050453680240545040250450525\winmgr.exe = %Windows%\M-5050453680240545040250450525\winmgr.exe:*:Enabled:Microsoft Windows Manager

Propagation

This Worm drops copies of itself in the following drives:

• Removable
• Network

It sends messages that contain links to sites hosting remote copies of itself using the following instant-messaging (IM) applications:

• Yahoo Messenger
• Skype

Backdoor Routine

This Worm executes the following commands from a remote malicious user:

• Uninstall itself (deletes self and remove its autorun key)
• Update itself
• Get Locale information
• Download and execute files
• Propagate via specified Instant Messaging Applications

It connects to the following websites to send and receive information:

• sr{BLOCKED}.ru
• sr{BLOCKED}.ru

Other Details

This Worm connects to the following URL(s) to get the affected system's IP address:

• http://api.wipmania.com

It does the following:

• it does not proceed to routine if one of the following checking is set true:
  • checks if the following modules are loaded in memory:
    • SbieDll.dll
    • SbieDllX.dll
  • checks if the following processes are running:
    • VBoxService.exe
    • vmtoolsd.exe
  • checks if sample is under the following virtual systems:
    • qemu
    • virtual
    • vmware
• propagates via removable drives, network drives, and specified Instant Messaging applications
• moves files from removable drive to created folder {Removable or Network Drive}:\_

It accesses the following URL(s) to get the affected system's location:

• http://api.wipmania.com