WORM_PHORPIEX.YOV

This Worm arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It modifies registry entries to disable various system services. This action prevents most of the system functions to be used.

It drops copies of itself into all the removable drives connected to an affected system. It drops copies of itself into network drives. It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

However, as of this writing, the said sites are inaccessible.

Arrival Details

This Worm arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Worm adds the following folders:

• {removable or network drive}:\_
• %Windows%\M-5050480268465846240752862405642857248045
• %User Temp%\ns{5-random characters}.tmp

(Note: %Windows% is the Windows folder, where it usually is C:\Windows on all Windows operating system versions.. %User Temp% is the user's temporary folder, where it usually is C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local\Temp on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

It drops the following copies of itself into the affected system:

• {removable or network drive}:\_\DeviceConfigManager.exe

It drops the following copies of itself into the affected system and executes them:

• %Windows%\M-5050480268465846240752862405642857248045\winmgr.exe

(Note: %Windows% is the Windows folder, where it usually is C:\Windows on all Windows operating system versions.)

It drops the following files:

• {removable/network drive}:\.lnk -> Shortcut for DeviceConfigManager.vbs
• {removable/network drive}:\DeviceConfigManager.vbs -> Executes _\DeviceConfigManager.exe
• {removable/network drive}:\autorun.inf -> Automatically executes _\DeviceConfigManager.exe on plug-in
• {removable/network drive}:\_\DeviceConfigManager.exe
• %User Temp%\Choriamb.dat -> Encrypted malicious code
• %User Temp%\ns{5-random character}.tmp\System.dll
• %User Temp%\{random filename}.bat -> deletes the original malware file and is deleted after execution
• %User Temp%\executions.dll -> Decrypts the malicious code and injects it into itself

(Note: %User Temp% is the user's temporary folder, where it usually is C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local\Temp on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• t30

Autostart Technique

This Worm adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Microsoft Windows Manager = %Windows%\M-5050480268465846240752862405642857248045\winmgr.exe

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Microsoft Windows Manager = %Windows%\M-5050480268465846240752862405642857248045\winmgr.exe

Other System Modifications

This Worm modifies registry entries to disable the following system services:

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
services\WinDefend
Start = 4

It creates the following registry entry(ies) to bypass Windows Firewall:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\AuthorizedApplications\
List
%Windows%\M-5050480268465846240752862405642857248045\winmgr.exe = %Windows%\M-5050480268465846240752862405642857248045\winmgr.exe:*:Enabled:Microsoft Windows Manager

Propagation

This Worm drops copies of itself into all the removable drives connected to an affected system.

It drops copies of itself into network drives.

It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

The said .INF file contains the following strings:

{garbage strings}
[autorun]
{garbage strings}
icon=%SystemRoot%\system32\SHELL32.dll,4
{garbage strings}
open=_\DeviceConfigManager.exe
{garbage strings}
UseAutoPlay=1
{garbage strings}

Backdoor Routine

This Worm connects to the following URL(s) to send and receive commands from a remote malicious user:

• {BLOCKED}.{BLOCKED}.87.80:5050
• {BLOCKED}uhgsorhugih.ru
• {BLOCKED}oeaboeubfuo.ru
• {BLOCKED}hpnpnapcipa.ru
• {BLOCKED}beogoaehgoi.ru
• {BLOCKED}haioeoaiegj.ru
• {BLOCKED}eogbuaeofua.ru
• {BLOCKED}biiegiiciib.ru
• {BLOCKED}boabobfaoua.ru
• {BLOCKED}vienvaiebai.ru
• {BLOCKED}odbuebieibg.ru
• {BLOCKED}uhgsorhugih.su
• {BLOCKED}oeaboeubfuo.su
• {BLOCKED}hpnpnapcipa.su
• {BLOCKED}beogoaehgoi.su
• {BLOCKED}haioeoaiegj.su
• {BLOCKED}eogbuaeofua.su
• {BLOCKED}biiegiiciib.su
• {BLOCKED}boabobfaoua.su
• {BLOCKED}vienvaiebai.su
• {BLOCKED}odbuebieibg.su
• {BLOCKED}uhgsorhugih.ws
• {BLOCKED}oeaboeubfuo.ws
• {BLOCKED}hpnpnapcipa.ws
• {BLOCKED}beogoaehgoi.ws
• {BLOCKED}haioeoaiegj.ws
• {BLOCKED}eogbuaeofua.ws
• {BLOCKED}biiegiiciib.ws
• {BLOCKED}boabobfaoua.ws
• {BLOCKED}vienvaiebai.ws
• {BLOCKED}odbuebieibg.ws
• {BLOCKED}uhgsorhugih.in
• {BLOCKED}oeaboeubfuo.in
• {BLOCKED}hpnpnapcipa.in
• {BLOCKED}beogoaehgoi.in
• {BLOCKED}haioeoaiegj.in
• {BLOCKED}eogbuaeofua.in
• {BLOCKED}biiegiiciib.in
• {BLOCKED}boabobfaoua.in
• {BLOCKED}vienvaiebai.in
• {BLOCKED}odbuebieibg.in
• {BLOCKED}uhgsorhugih.kz
• {BLOCKED}oeaboeubfuo.kz
• {BLOCKED}hpnpnapcipa.kz
• {BLOCKED}beogoaehgoi.kz
• {BLOCKED}haioeoaiegj.kz
• {BLOCKED}eogbuaeofua.kz
• {BLOCKED}biiegiiciib.kz
• {BLOCKED}boabobfaoua.kz
• {BLOCKED}vienvaiebai.kz
• {BLOCKED}odbuebieibg.kz
• {BLOCKED}uhgsorhugih.nl
• {BLOCKED}oeaboeubfuo.nl
• {BLOCKED}hpnpnapcipa.nl
• {BLOCKED}beogoaehgoi.nl
• {BLOCKED}haioeoaiegj.nl
• {BLOCKED}eogbuaeofua.nl
• {BLOCKED}biiegiiciib.nl
• {BLOCKED}boabobfaoua.nl
• {BLOCKED}vienvaiebai.nl
• {BLOCKED}odbuebieibg.nl
• {BLOCKED}uhgsorhugih.de
• {BLOCKED}oeaboeubfuo.de
• {BLOCKED}hpnpnapcipa.de
• {BLOCKED}beogoaehgoi.de
• {BLOCKED}haioeoaiegj.de
• {BLOCKED}eogbuaeofua.de
• {BLOCKED}biiegiiciib.de
• {BLOCKED}boabobfaoua.de
• {BLOCKED}vienvaiebai.de
• {BLOCKED}odbuebieibg.de
• {BLOCKED}uhgsorhugih.fr
• {BLOCKED}oeaboeubfuo.fr
• {BLOCKED}hpnpnapcipa.fr
• {BLOCKED}beogoaehgoi.fr
• {BLOCKED}haioeoaiegj.fr
• {BLOCKED}eogbuaeofua.fr
• {BLOCKED}biiegiiciib.fr
• {BLOCKED}boabobfaoua.fr
• {BLOCKED}vienvaiebai.fr
• {BLOCKED}odbuebieibg.fr
• {BLOCKED}uhgsorhugih.it
• {BLOCKED}oeaboeubfuo.it
• {BLOCKED}hpnpnapcipa.it
• {BLOCKED}beogoaehgoi.it
• {BLOCKED}haioeoaiegj.it
• {BLOCKED}eogbuaeofua.it
• {BLOCKED}biiegiiciib.it
• {BLOCKED}boabobfaoua.it
• {BLOCKED}vienvaiebai.it
• {BLOCKED}odbuebieibg.it
• {BLOCKED}uhgsorhugih.at
• {BLOCKED}oeaboeubfuo.at
• {BLOCKED}hpnpnapcipa.at
• {BLOCKED}beogoaehgoi.at
• {BLOCKED}haioeoaiegj.at
• {BLOCKED}eogbuaeofua.at
• {BLOCKED}biiegiiciib.at
• {BLOCKED}boabobfaoua.at
• {BLOCKED}vienvaiebai.at
• {BLOCKED}odbuebieibg.at
• {BLOCKED}uhgsorhugih.ua
• {BLOCKED}oeaboeubfuo.ua
• {BLOCKED}hpnpnapcipa.ua
• {BLOCKED}beogoaehgoi.ua
• {BLOCKED}haioeoaiegj.ua
• {BLOCKED}eogbuaeofua.ua
• {BLOCKED}biiegiiciib.ua
• {BLOCKED}boabobfaoua.ua
• {BLOCKED}vienvaiebai.ua
• {BLOCKED}odbuebieibg.ua
• {BLOCKED}uhgsorhugih.be
• {BLOCKED}oeaboeubfuo.be
• {BLOCKED}hpnpnapcipa.be
• {BLOCKED}beogoaehgoi.be
• {BLOCKED}haioeoaiegj.be
• {BLOCKED}eogbuaeofua.be
• {BLOCKED}biiegiiciib.be
• {BLOCKED}boabobfaoua.be
• {BLOCKED}vienvaiebai.be
• {BLOCKED}odbuebieibg.be
• {BLOCKED}uhgsorhugih.hu
• {BLOCKED}oeaboeubfuo.hu
• {BLOCKED}hpnpnapcipa.hu
• {BLOCKED}beogoaehgoi.hu
• {BLOCKED}haioeoaiegj.hu
• {BLOCKED}eogbuaeofua.hu
• {BLOCKED}biiegiiciib.hu
• {BLOCKED}boabobfaoua.hu
• {BLOCKED}vienvaiebai.hu
• {BLOCKED}odbuebieibg.hu
• {BLOCKED}uhgsorhugih.ir
• {BLOCKED}oeaboeubfuo.ir
• {BLOCKED}hpnpnapcipa.ir
• {BLOCKED}beogoaehgoi.ir
• {BLOCKED}haioeoaiegj.ir
• {BLOCKED}eogbuaeofua.ir
• {BLOCKED}biiegiiciib.ir
• {BLOCKED}boabobfaoua.ir
• {BLOCKED}vienvaiebai.ir
• {BLOCKED}odbuebieibg.ir
• {BLOCKED}uhgsorhugih.pl
• {BLOCKED}oeaboeubfuo.pl
• {BLOCKED}hpnpnapcipa.pl
• {BLOCKED}beogoaehgoi.pl
• {BLOCKED}haioeoaiegj.pl
• {BLOCKED}eogbuaeofua.pl
• {BLOCKED}biiegiiciib.pl
• {BLOCKED}boabobfaoua.pl
• {BLOCKED}vienvaiebai.pl
• {BLOCKED}odbuebieibg.pl
• {BLOCKED}uhgsorhugih.es
• {BLOCKED}oeaboeubfuo.es
• {BLOCKED}hpnpnapcipa.es
• {BLOCKED}beogoaehgoi.es
• {BLOCKED}haioeoaiegj.es
• {BLOCKED}eogbuaeofua.es
• {BLOCKED}biiegiiciib.es
• {BLOCKED}boabobfaoua.es
• {BLOCKED}vienvaiebai.es
• {BLOCKED}odbuebieibg.es
• {BLOCKED}uhgsorhugih.ro
• {BLOCKED}oeaboeubfuo.ro
• {BLOCKED}hpnpnapcipa.ro
• {BLOCKED}beogoaehgoi.ro
• {BLOCKED}haioeoaiegj.ro
• {BLOCKED}eogbuaeofua.ro
• {BLOCKED}biiegiiciib.ro
• {BLOCKED}boabobfaoua.ro
• {BLOCKED}vienvaiebai.ro
• {BLOCKED}odbuebieibg.ro
• {BLOCKED}uhgsorhugih.lu
• {BLOCKED}oeaboeubfuo.lu
• {BLOCKED}hpnpnapcipa.lu
• {BLOCKED}beogoaehgoi.lu
• {BLOCKED}haioeoaiegj.lu
• {BLOCKED}eogbuaeofua.lu
• {BLOCKED}biiegiiciib.lu
• {BLOCKED}boabobfaoua.lu
• {BLOCKED}vienvaiebai.lu
• {BLOCKED}odbuebieibg.lu
• {BLOCKED}uhgsorhugih.gr
• {BLOCKED}oeaboeubfuo.gr
• {BLOCKED}hpnpnapcipa.gr
• {BLOCKED}beogoaehgoi.gr
• {BLOCKED}haioeoaiegj.gr
• {BLOCKED}eogbuaeofua.gr
• {BLOCKED}biiegiiciib.gr
• {BLOCKED}boabobfaoua.gr
• {BLOCKED}vienvaiebai.gr
• {BLOCKED}odbuebieibg.gr
• {BLOCKED}uhgsorhugih.md
• {BLOCKED}oeaboeubfuo.md
• {BLOCKED}hpnpnapcipa.md
• {BLOCKED}beogoaehgoi.md
• {BLOCKED}haioeoaiegj.md
• {BLOCKED}eogbuaeofua.md
• {BLOCKED}biiegiiciib.md
• {BLOCKED}boabobfaoua.md
• {BLOCKED}vienvaiebai.md
• {BLOCKED}odbuebieibg.md
• {BLOCKED}uhgsorhugih.br
• {BLOCKED}oeaboeubfuo.br
• {BLOCKED}hpnpnapcipa.br
• {BLOCKED}beogoaehgoi.br
• {BLOCKED}haioeoaiegj.br
• {BLOCKED}eogbuaeofua.br
• {BLOCKED}biiegiiciib.br
• {BLOCKED}boabobfaoua.br
• {BLOCKED}vienvaiebai.br
• {BLOCKED}odbuebieibg.br
• {BLOCKED}uhgsorhugih.net
• {BLOCKED}oeaboeubfuo.net
• {BLOCKED}hpnpnapcipa.net
• {BLOCKED}beogoaehgoi.net
• {BLOCKED}haioeoaiegj.net
• {BLOCKED}eogbuaeofua.net
• {BLOCKED}biiegiiciib.net
• {BLOCKED}boabobfaoua.net
• {BLOCKED}vienvaiebai.net
• {BLOCKED}odbuebieibg.net
• {BLOCKED}uhgsorhugih.org
• {BLOCKED}oeaboeubfuo.org
• {BLOCKED}hpnpnapcipa.org
• {BLOCKED}beogoaehgoi.org
• {BLOCKED}haioeoaiegj.org
• {BLOCKED}eogbuaeofua.org
• {BLOCKED}biiegiiciib.org
• {BLOCKED}boabobfaoua.org
• {BLOCKED}vienvaiebai.org
• {BLOCKED}odbuebieibg.org
• {BLOCKED}uhgsorhugih.com
• {BLOCKED}oeaboeubfuo.com
• {BLOCKED}hpnpnapcipa.com
• {BLOCKED}beogoaehgoi.com
• {BLOCKED}haioeoaiegj.com
• {BLOCKED}eogbuaeofua.com
• {BLOCKED}biiegiiciib.com
• {BLOCKED}boabobfaoua.com
• {BLOCKED}vienvaiebai.com
• {BLOCKED}odbuebieibg.com
• {BLOCKED}uhgsorhugih.name
• {BLOCKED}oeaboeubfuo.name
• {BLOCKED}hpnpnapcipa.name
• {BLOCKED}beogoaehgoi.name
• {BLOCKED}haioeoaiegj.name
• {BLOCKED}eogbuaeofua.name
• {BLOCKED}biiegiiciib.name
• {BLOCKED}boabobfaoua.name
• {BLOCKED}vienvaiebai.name
• {BLOCKED}odbuebieibg.name
• {BLOCKED}uhgsorhugih.info
• {BLOCKED}oeaboeubfuo.info
• {BLOCKED}hpnpnapcipa.info
• {BLOCKED}beogoaehgoi.info
• {BLOCKED}haioeoaiegj.info
• {BLOCKED}eogbuaeofua.info
• {BLOCKED}biiegiiciib.info
• {BLOCKED}boabobfaoua.info
• {BLOCKED}vienvaiebai.info
• {BLOCKED}odbuebieibg.info
• {BLOCKED}uhgsorhugih.mobi
• {BLOCKED}oeaboeubfuo.mobi
• {BLOCKED}hpnpnapcipa.mobi
• {BLOCKED}beogoaehgoi.mobi
• {BLOCKED}haioeoaiegj.mobi
• {BLOCKED}eogbuaeofua.mobi
• {BLOCKED}biiegiiciib.mobi
• {BLOCKED}boabobfaoua.mobi
• {BLOCKED}vienvaiebai.mobi
• {BLOCKED}odbuebieibg.mobi

However, as of this writing, the said sites are inaccessible.

It accesses a remote Internet Relay Chat (IRC) server where it receives the following commands from a remote malicious user:

• Download and execute files
• Join another IRC server
• Uninstall itself

Other Details

This Worm does the following:

• It can modify the data in the clipboard.
• Checks the following strings in the Device Driver information to identify if it is running in a Virtual Environment:
  
  • qemu
  • virtual
  • vmware
• It moves all files and folders in the removable or network drive inside the created {removable or network drive}:\_ folder.
• It replaces any copied Cryptocurrency wallet address in the clipboard with the following hard-coded address:
  • {BLOCKED}43e7abe2708037fc1acdca83b37466a299
  • {BLOCKED}5qfStF1HrVXaZ1eE3X4ntnbsx
  • {BLOCKED}rnwMJgX5ZTeDPYhXXpu9TrarhTpu4KhDVwpqADSRevDoswWFr6MNqj3PGR4PGXzCGYQw7UemxRoRxCC97rFhM4i
  • {BLOCKED}c9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQm7QWX9mxQh4goy76E
  • {BLOCKED}2tNHcu7qmjoVpRaQY2a3kAMXGGpG
  • {BLOCKED}mXzwZtL5ua5HYFHKxFz3HFcNi8
  • {BLOCKED}U9w9Scyan47L2YhKiVqhpXxH
  • {BLOCKED}5tMx1WKAVeT2KUcFWaWueywoz
  • {BLOCKED}BdYbDTsV6k37TneN2Svi4e1PXF
  • {BLOCKED}Cu2m4gXtYFYPDpVAmYr5qM4u6UECk
  • {BLOCKED}xzR8UQSnTzaAWsBHHQFxoB9jp
  • {BLOCKED}dguJDf3A2YkvwQvfMPwfZDZRC
  • {BLOCKED}5cSAuE26vUiYhkew1aVs
  • {BLOCKED}6ZbrUbKNk7LnqgNmg6XRy9hnULTiN