WORM_KOLAB.SMK

This worm connects to specific IRC channels and uses the nick n3t.

It creates the mutex "S3xY!" for its main executable.

It may execute certain commands from a remote malicious user.

This Trojan arrives by connecting affected removable drives to a system. It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It drops copies of itself in all removable drives. It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

It connects to a website to send and receive information.

Arrival Details

This Trojan arrives by connecting affected removable drives to a system.

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan injects itself into the following processes running in the affected system's memory:

• Explorer.exe

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• muipcdraotse

Propagation

This Trojan drops copies of itself in all removable drives.

It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

The said .INF file contains the following strings:

[AutoRun]
open=
icon=%windir%\system32\SHELL32.dll,4
action=Open drive to view files with Explorer
shell\open=Open
shell\open\command=
shell\open\default=1
shell\explore=Explore
shell\explore\command=
shell\search=Search...
shell\search\command=
useautoplay=1

It sends copies of itself to target recipients using the following instant-messaging (IM) applications:

• Skype
• Blast IM
• Paltalk

Backdoor Routine

This Trojan joins any of the following IRC channel(s):

• ##4ucku

It connects to the following websites to send and receive information:

• {BLOCKED}7.intelsecurity.su

NOTES:

It connects to specific IRC channels and uses the nick n3t.

It creates the mutex "S3xY!" for its main executable.

It may execute the following commands from a remote malicious user: