WORM_NITOL.SMB

This worm arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It is injected into all running processes to remain memory resident.

It executes commands from a remote malicious user, effectively compromising the affected system.

Arrival Details

This worm arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This worm drops a copy of itself in the following folders using different file names:

• %System%\{random filename}.exe

(Note: %System% is the Windows system folder, which is usually C:\Windows\System32.)

It is injected into all running processes to remain memory resident.

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• {random mutex} same as the name of the added service

Autostart Technique

This worm registers itself as a system service to ensure its automatic execution at every system startup by adding the following registry entries:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\{random key}
ImagePath = "%System%\{random filename}.exe"

Other System Modifications

This worm adds the following registry entries as part of its installation routine:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\{random key}\Security
Security = {Randonm Data}

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\Session Manager
PendingFileRenameOperations = %User Temp%\SOFTWARE.LOG

Propagation

This worm drops the following copy of itself in all physical and removable drives:

• RCX3.tmp
• VIP.exe
• Server.exe

Backdoor Routine

This worm executes the following commands from a remote malicious user:

• Access URL using Internet Explorer
• Download and execute arbitrary files
• Update copy

It posts the following information to its command and control (C&C) server:

• Computer Name
• CPU Speed
• OS Product Name
• Memory Size

Download Routine

This worm connects to the following website(s) to download and execute a malicious file:

• {BLOCKED}.{BLOCKED}.137.238:{random port}
• {BLOCKED}.{BLOCKED}.62.73:8000
• {random domain}.{BLOCKED}2.org
• rat2.{BLOCKED}li.com

NOTES:

This worm drops a copy of itself in all folders and .RAR archives in all physical and removable drives containing an .EXE file using the file name LPK.DLL.