WORM_KOLAB.SMT

It monitors certain processes to steal user credentials.

This worm arrives via removable drives. It may be downloaded by other malware/grayware/spyware from remote sites. It may be unknowingly downloaded by a user while visiting malicious websites.

It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

It executes commands from a remote malicious user, effectively compromising the affected system.

Arrival Details

This worm arrives via removable drives.

It may be downloaded by other malware/grayware/spyware from remote sites.

It may be unknowingly downloaded by a user while visiting malicious websites.

Installation

This worm drops the following component file(s):

• {drive letter}:\hotenvy\coldenvy\Desktop.ini

It drops the following copies of itself into the affected system:

• %Application Data%\traymgr.exe

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Windows\Profiles\{user name}\Application Data on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Application Data on Windows NT, and C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, XP, and Server 2003.)

Autostart Technique

This worm adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
Explorer\Run
JavaTray = %Application Data%\traymgr.exe

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MicrosoftNAPC = %Application Data%\traymgr.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\policies\
Explorer\Run
JavaTray = %Application Data%\traymgr.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
MicrosoftNAPC = %Application Data%\traymgr.exe

Other System Modifications

This worm modifies the following registry entries:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced\Folder\Hidden\
SHOWALL
CheckedValue = 0

(Note: The default value data of the said registry entry is 1.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\SystemRestore
DisableSR = 1

(Note: The default value data of the said registry entry is 0.)

It deletes the following registry keys:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot

Propagation

This worm creates the following folders in all removable drives:

• {drive letter}:\hotenvy
• {drive letter}:\hotenvy\coldenvy

It drops the following copy(ies) of itself in all removable drives:

• {drive letter}:\hotenvy\coldenvy\traymgr.exe

It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

The said .INF file contains the following strings:

autorun]
[autorun[
[autorun]
open=hotenvy\coldenvy\traymgr.exe
icon=%syStEmrOot%\sySTeM32\sHELL32.dll,4
action=Open folder to view files
UseAuTOPLAY=1
shell\open\command=hotenvy\coldenvy\traymgr.exe
shell\Explore\Command=hotenvy\coldenvy\traymgr.exe

Backdoor Routine

This worm executes the following commands from a remote malicious user:

• Spread via MSN Messenger
• Perform a DDoS attack
• Keylog

It connects to the following URL(s) to send and receive commands from a remote malicious user:

• {BLOCKED}ftupdate.legion014.com

Process Termination

This worm terminates processes or services that contain any of the following strings if found running in the affected system's memory:

• AdvancedConnectionViewer.exe
• advscan
• Analyzer
• Anti-Malware
• Anti-Spyware
• Anti-Virus
• AntiSpyware
• AntiVirus
• Auto Start and Process Viewer : www.konradp.com
• autostart_and_process_viewer.exe
• Connectionwatcher.exe
• cports.exe
• Ethereal
• File Monitor - Sysinternals: www.sysinternals.com
• FileAlyzer.exe
• filemon.exe
• firefox.exe
• FirePass|
• flock.exe
• HijackThis
• Hijackthis.exe
• HookExplorer.exe
• HostBooter
• hotfix
• Killbox.exe
• mbam.exe
• MSASCui.exe
• msconfig.exe
• PrcView.exe
• Process Explorer - Sysinternals: www.sysinternals.com
• Process Monitor - Sysinternals: www.sysinternals.com
• procexp.exe
• procmon.exe
• RegAlyzer.exe
• RegScanner.exe
• RunAlyzer.exe
• seamonkey.exe
• SmartSniff
• smsniff.exe
• SocketSniff
• SpybotSD.exe
• Startup Defender.exe
• Stinger
• sysAnalyzer
• sysclean.exe
• TCPView - Sysinternals: www.sysinternals.com
• Tcpview.exe
• TeaTimer.exe
• The Wireshark Network Analyzer
• Unlocker.exe
• UnlockerAssistant.exe
• Winpatrol.exe
• WinPcap
• Wireshark
• wireshark.exe
• www.konradp.com
• www.malwarebytes.org
• www.sysinternals.com

Other Details

Internet activities are monitored by a malicious user.

It does the following:

• It monitors the following processes to steal user credentials:
  
  • firefox.exe
  • iexplore.exe
  • opera.exe
  • flock.exe
  • seamonkey.exe
  • safari.exe
  • netscape.exe