WORM_ROTINOM.SME

This Worm arrives by connecting affected removable drives to a system. It may arrive bundled with malware packages as a malware component. It may be unknowingly downloaded by a user while visiting malicious websites.

It uses the default Windows folder icon to trick users into opening the file. Double-clicking the file executes this malware.

It modifies registry entries to hide files with System and Read-only attributes.

It drops copies of itself in removable drives. These dropped copies use the names of the folders located on the said drives for their file names.

Arrival Details

This Worm arrives by connecting affected removable drives to a system.

It may arrive bundled with malware packages as a malware component.

It may be unknowingly downloaded by a user while visiting malicious websites.

Installation

This Worm adds the following folders:

• %AppDataLocal%\start
• %AppDataLocal%\S-1-5-31-1286970278978-5713669491-166975984-320\tlsr
• %AppDataLocal%\S-1-5-31-1286970278978-5713669491-166975984-320\Rotinom
• %AppDataLocal%\S-1-5-31-1286970278978-5713669491-166975984-320\dmc
• %AppDataLocal%\S-1-5-31-1286970278978-5713669491-166975984-320
• {Malware Path}\{Malware File Name}

(Note: %AppDataLocal% is the Application Data folder found in Local Settings, where it is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

It drops the following copies of itself into the affected system:

• %AppDataLocal%\start\update.exe

(Note: %AppDataLocal% is the Application Data folder found in Local Settings, where it is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

It uses the default Windows folder icon to trick users into opening the file. Double-clicking the file executes this malware.

Other System Modifications

This Worm modifies the following registry key(s)/entry(ies) as part of its installation routine:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Shell Folders
Startup = "%AppDataLocal%\start"

(Note: The default value data of the said registry entry is "%User Profile%\Start Menu\Programs\Startup".)

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
User Shell Folders
Startup = "%AppDataLocal%\start"

(Note: The default value data of the said registry entry is "%User Profile%\Start Menu\Programs\Startup".)

It modifies the following registry entries to hide files with System and Read-only attributes:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
Hidden = 2

(Note: The default value data of the said registry entry is 1.)

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
HideFileExt = 1

(Note: The default value data of the said registry entry is 0.)

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
ShowSuperHidden = 0

(Note: The default value data of the said registry entry is 1.)

Propagation

This Worm drops copies of itself in removable drives. These dropped copies use the names of the folders located on the said drives for their file names.

Other Details

This Worm does the following:

• This worm creates and executes the following folder to deceive the user and hide its execution:
  • {Malware Path}\{Malware Filename}
• This worm copies the contents of the removable drives in the following created folder:
  
  • %AppDataLocal%\S-1-5-31-1286970278978-5713669491-166975984-320\Rotinom

(Note: %AppDataLocal% is the Application Data folder found in Local Settings, where it is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)