ALS_MEDRE.SM

This worm arrives as an attachment to email messages spammed by other malware/grayware or malicious users. It may arrive bundled with malware packages as a malware component. It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This worm arrives as an attachment to email messages spammed by other malware/grayware or malicious users.

It may arrive bundled with malware packages as a malware component.

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This worm drops the following copies of itself into the affected system:

• %System%\acad.fas
• %Windows%\acad.fas
• {current working directory of drawing file}\cad.fas
• {current working directory of drawing file}\acad.fas
• {AutoCad support path}\cad.fas
• {AutoCad support path}\acad.fas
• %System%\{random characters}\acad.fas

(Note: %System% is the Windows system folder, which is usually C:\Windows\System32.. %Windows% is the Windows folder, which is usually C:\Windows.)

Other System Modifications

This worm adds the following registry entries:

HKEY_CURRENT_USER\­Software\­Microsoft\
­Windows\­Windows Error Reporting
FILE = "{drawing file path and name}"

HKEY_CURRENT_USER\­Software\­Microsoft\
­Windows\­Windows Error Reporting
FILE-G = "{random}"

HKEY_CURRENT_USER\­Software\­Microsoft\
­Windows\­Windows Error Reporting
Time = "{date and time}"

NOTES:

It searches for the following file:

• {AutoCad Installion Folder}\­Support\­acad20{last 2 digir of year}.lsp

If found, it writes (if (findfile “cad.fas”)(load “cad.fas”)) to the said file. This results to the execution of its dropped copy once a drawing file is opened.

It uses the following SMTP servers to send information via email:

• smtp.{BLOCKED}q.com
• smtp.{BLOCKED}3.com

The affected AutoCad versions are 2000, 2002, and 2004 up to 2015.