WORM_LOLBOT.BR

This worm arrives via removable drives. It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This worm arrives via removable drives.

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This worm drops the following copies of itself into the affected system and executes them:

• %Application Data%\HEX-5823-6893-6818\jusched.exe
• %System Root%\Public\HEX-5823-6893-6818\jusched.exe (for Windows 7 and Vista)

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.. %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.)

It drops the following files:

• {Drive Letter}:\{folder name}s.lnk - if the removable drive contains folders
• %System%\winrtsnr.txt

(Note: %System% is the Windows system folder, which is usually C:\Windows\System32.)

It creates the following folders:

• %Application Data%\HEX-5823-6893-6818
• %System Root%\Public\HEX-5823-6893-6818 (for Windows 7 and Vista)

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.. %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.)

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• l0lkn0lltr0ll

Autostart Technique

This worm adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Java Update Manager = "%Application Data%\HEX-5823-6893-6818\jusched.exe"

Other System Modifications

This worm creates the following registry entry(ies) to bypass Windows Firewall:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\AuthorizedApplications\
List
%Application Data%\HEX-5823-6893-6818\jusched.exe = "%Application Data%\HEX-5823-6893-6818\jusched.exe:*:Enabled:Java Update Manager"

Propagation

This worm creates the following folders in all removable drives:

• {Drive Letter}:\{random digit}

It drops the following copy(ies) of itself in all removable drives:

• {Drive Letter}:\{random digit}\{folder name}.exe

It sends messages that contain links to sites hosting remote copies of itself using the following instant-messaging (IM) applications:

• Yahoo
• XFire
• Skype
• PalTalk
• ICQ
• GTalk
• MSN

Backdoor Routine

This worm connects to any of the following IRC server(s):

• http://{BLOCKED}ution.nicaze.net

It accesses a remote Internet Relay Chat (IRC) server where it receives the following commands from a remote malicious user:

• Upload files
• Download and execute files

Information Theft

This worm gathers the following data:

• Host Name
• Locale Info
• OS Version

NOTES:

This worm accesses the following IRC Server to send the gathered information:

• http://{BLOCKED}ution.nicaze.net

However, as of this writing, the said site is inaccessible.

It drops shortcut files pointing to the copy of itself in removable drives. These dropped .LNK files use the names of the folders located on the said drives for their file names.

It then sets the attributes of the original folders to Hidden to trick the user into clicking the .LNK files.

It does not have rootkit capabilities.

It does not exploit any vulnerability.