WORM_BLADAB.CV

This worm arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It drops copies of itself in the Windows Common Startup folder to enable its automatic execution at every system startup.

It executes commands from a remote malicious user, effectively compromising the affected system.

As of this writing, the said sites are inaccessible.

Arrival Details

This worm arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This worm drops the following copies of itself into the affected system:

• %User Temp%\WINDOWS.exe
• %User Temp%\Trojan.exe
• %User Startup%\{random}.exe

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.. %User Startup% is the current user's Startup folder, which is usually C:\Windows\Profiles\{user name}\Start Menu\Programs\Startup on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Start Menu\Programs\Startup on Windows NT, and C:\Documents and Settings\{User name}\Start Menu\Programs\Startup.)

It drops the following file(s)/component(s):

• {Malware Path}\.tmp - Contains logged key strokes

Autostart Technique

This worm adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
{random} = ""%User Temp%\WINDOWS.exe".."

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Run
{random} = ""%User Temp%\WINDOWS.exe".."

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
{random} = ""%User Temp%\Trojan.exe".."

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Run
{random} = ""%User Temp%\Trojan.exe.exe"..

It drops copies of itself in the Windows Common Startup folder to enable its automatic execution at every system startup.

Other System Modifications

This worm adds the following registry keys:

HKEY_CURRENT_USER\Software\{random}

It adds the following registry entries:

HKEY_CURRENT_USER\Software\{random}
US = "@"

HKEY_CURRENT_USER\Environment
SEE_MASK_NOZONECHECKS = "1"

It creates the following registry entry(ies) to bypass Windows Firewall:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\AuthorizedApplications\
List
%User Temp%\WINDOWS.exe = "%User Temp%\WINDOWS.exe:*:Enabled:WINDOWS.exe"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\AuthorizedApplications\
List
%User Temp%\Trojan.exe = "%User Temp%\Trojan.exe:*:Enabled:Trojan.exe"

Propagation

This worm drops the following copy(ies) of itself in all removable drives:

• Removable Drive}:\{random}.exe - hidden

Backdoor Routine

This worm executes the following commands from a remote malicious user:

• Download and execute files
• Compress files for uploading
• Load plugins
• Ping
• Registry management
• Remote shell execution
• Restart
• Screenshot
• Unistall itself
• Update itself
• Terminate itself
• Keylog

It connects to the following URL(s) to send and receive commands from a remote malicious user:

• {BLOCKED}r.{BLOCKED}ties.com
• {BLOCKED}n2.{BLOCKED}p.biz

Download Routine

As of this writing, the said sites are inaccessible.

Information Theft

This worm gathers the following data:

• Drive Information
• Driver Description
• Volume Information

NOTES:
This worm creates .LNK (shortcut) files using file names found in removable drives. It then hides the original file tricking users to click .LNK files. This .LNK files point out to a dropped copy of itself in the removable drive.