Worm.Win32.DORKBOT.TIGAAAW

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Löscht Dateien, so dass Programme und Anwendungen nicht ordnungsgemäß ausgeführt werden.

Beendet sich selbst, falls festgestellt wird, dass die Ausführung in einer virtuellen Umgebung erfolgt.

Übertragungsdetails

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

Schleust die folgenden Dateien ein:

• {Removable Drive}:\_\autorun.inf -> contains the following strings "[AUtoRuN]",LF,"ShEllExECUte=__\DriveMgr.exe",LF,"UseAUtoPlAY=1"
• {Removable Drive}:\__\.lnk -> points to the dropped copy
• %Application Data%\winsvcs.txt

(Hinweis: %Application Data% ist der Ordner 'Anwendungsdaten' für den aktuellen Benutzer, normalerweise C:\Windows\Profile\{Benutzername}\Anwendungsdaten unter Windows 98 und ME, C:\WINNT\Profile\{Benutzername}\Anwendungsdaten unter Windows NT, C:\Dokumente und Einstellungen\{Benutzername}\Lokale Einstellungen\Anwendungsdaten unter Windows 2000(32-bit), XP und Server 2003(32-bit) und C:\Users\{Benutzername}\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) und 10(64-bit).)

Erstellt die folgenden Ordner:

• {Removable Drive}:\_

Fügt die folgenden Mutexe hinzu, damit nur jeweils eine ihrer Kopien ausgeführt wird:

• {random characters}

Andere Systemänderungen

Löscht die folgenden Dateien:

• {malware name}:Zone.Identifier

Ändert die folgenden Registrierungseinträge:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
FirewallDisableNotify = 1

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
AutoUpdateDisableNotify = 1

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
UpdatesDisableNotify = 1

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
AntiVirusDisableNotify = 1

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
FirewallOverride = 1

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
UpdatesOverride = 1

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
AntiVirusOverride = 1

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\SystemRestore
DisableSR = 1

Verbreitung

Schleust folgende Kopie(n) von sich selbst in alle Wechsellaufwerke ein:

• {Removable Drive}:\_\DriveMgr.exe

Andere Details

It connects to the following possibly malicious URL:

• hxxp://{BLOCKED}.27.132/
• hxxp://urusurofhsor{BLOCKED}.su/
• hxxp://aeifaeifhutu{BLOCKED}.su/
• hxxp://rzhsudhugugf{BLOCKED}.su/
• hxxp://bfagzzezgaeg{BLOCKED}.su/
• hxxp://eaeuafhuaegf{BLOCKED}.su/
• hxxp://aeufuaehfiueh{BLOCKED}.su/
• hxxp://daedagheaueh{BLOCKED}.su/
• hxxp://aeoughaohegu{BLOCKED}.su/
• hxxp://eguaheoghouu{BLOCKED}.su/
• hxxp://huaeokaefoae{BLOCKED}.su/
• hxxp://afaeigaifgsg{BLOCKED}.su/
• hxxp://afaigaeigieuf{BLOCKED}.su/
• hxxp://geauhouefheu{BLOCKED}.su/
• hxxp://gaoheeuofhef{BLOCKED}.su/
• hxxp://gaouehaehfoae{BLOCKED}.su/
• hxxp://gaohrhurhuhru{BLOCKED}.su/
• hxxp://gaghpaheiafh{BLOCKED}.su/
• hxxp://gaoehuoaoefh{BLOCKED}.su/
• hxxp://aegohaohuoru{BLOCKED}.su/
• hxxp://befaheaiudeu{BLOCKED}.su/
• hxxp://urusurofhsorh{BLOCKED}.io/
• hxxp://aeifaeifhutu{BLOCKED}.io/
• hxxp://rzhsudhugugf{BLOCKED}.io/
• hxxp://bfagzzezgaeg{BLOCKED}.io/
• hxxp://eaeuafhuaegf{BLOCKED}.io/
• hxxp://aeufuaehfiue{BLOCKED}.io/
• hxxp://daedagheaueh{BLOCKED].io/
• hxxp://aeoughaohegu{BLOCKED}.io/
• hxxp://eguaheoghouug{BLOCKED}.io/
• hxxp://huaeokaefoae{BLOCKED}.io/
• hxxp://afaeigaifgsg{BLOCKED}.io/
• hxxp://afaigaeigieu{BLOCKED}.io/
• hxxp://geauhouefheu{BLOCKED}.io/
• hxxp://gaoheeuofhef{BLOCKED}.io/
• hxxp://gaouehaehfoa{BLOCKED}.io/
• hxxp://gaohrhurhuhr{BLOCKED}.io/
• hxxp://gaghpaheiafh{BLOCKED}.io/
• hxxp://gaoehuoaoefh{BLOCKED}.io/
• hxxp://aegohaohuoru{BLOCKED}.io/
• hxxp://befaheaiudeu{BLOCKED}.io/
• hxxp://urusurofhsor{BLOCKED}.cc/
• hxxp://aeifaeifhutu{BLOCKED}.cc/
• hxxp://rzhsudhugugf{BLOCKED}.cc/
• hxxp://bfagzzezgaeg{BLOCKED}.cc/
• hxxp://eaeuafhuaegf{BLOCKED}.cc/
• hxxp://aeufuaehfiue{BLOCKED}.cc/
• hxxp://daedagheaueh{BLOCKED}.cc/
• hxxp://aeoughaohegua{BLOCKED}.cc/
• hxxp://eguaheoghouu{BLOCKED}.cc/
• hxxp://huaeokaefoae{BLOCKED}.cc/
• hxxp://afaeigaifgsg{BLOCKED}.cc/
• hxxp://afaigaeigieu{BLOCKED}.cc/
• hxxp://geauhouefheu{BLOCKED}.cc/
• hxxp://gaoheeuofhef{BLOCKED}.cc/
• hxxp://gaouehaehfoa{BLOCKED}.cc/
• hxxp://gaohrhurhuhr{BLOCKED}.cc/
• hxxp://gaghpaheiafh{BLOCKED}.cc/
• hxxp://gaoehuoaoefh{BLOCKED}.cc/
• hxxp://aegohaohuoru{BLOCKED}.cc/
• hxxp://befaheaiudeu{BLOCKED}.cc/
• hxxp://urusurofhsor{BLOCKED}.co/
• hxxp://aeifaeifhutu{BLOCKED}.co/
• hxxp://rzhsudhugugf{BLOCKED}.co/
• hxxp://bfagzzezgaeg{BLOCKED}.co/
• hxxp://eaeuafhuaegf{BLOCKED}.co/
• hxxp://aeufuaehfiue{BLOCKED}.co/
• hxxp://daedagheaueh{BLOCKED}.co/
• hxxp://aeoughaohegu{BLOCKED}.co/
• hxxp://eguaheoghouu{BLOCKED}.co/
• hxxp://huaeokaefoae{BLOCKED}.co/
• hxxp://afaeigaifgsg{BLOCKED}.co/
• hxxp://afaigaeigieu{BLOCKED}.co/
• hxxp://geauhouefheu{BLOCKED}.co/
• hxxp://gaoheeuofhef{BLOCKED}.co/
• hxxp://gaouehaehfoa{BLOCKED}.co/
• hxxp://gaohrhurhuhr{BLOCKED}.co/
• hxxp://gaghpaheiafh{BLOCKED}.co/
• hxxp://gaoehuoaoefh{BLOCKED}.co/
• hxxp://aegohaohuoru{BLOCKED}.co/
• hxxp://befaheaiudeu{BLOCKED}.co/
• hxxp://{BLOCKED}.top/
• hxxp://aeifaeifhutu{BLOCKED}.top/
• hxxp://rzhsudhugugf{BLOCKED}.top/
• hxxp://bfagzzezgaeg{BLOCKED}.top/
• hxxp://eaeuafhuaegf{BLOCKED}.top/
• hxxp://aeufuaehfiue{BLOCKED}.top/
• hxxp://daedagheaueh{BLOCKED}.top/
• hxxp://aeoughaohegu{BLOCKED}.top/
• hxxp://eguaheoghouu{BLOCKED}.top/
• hxxp://huaeokaefoae{BLOCKED}.top/
• hxxp://afaeigaifgsg{BLOCKED}.top/
• hxxp://afaigaeigieu{BLOCKED}.top/
• hxxp://geauhouefheu{BLOCKED}.top/
• hxxp://gaoheeuofhef{BLOCKED}.top/
• hxxp://gaouehaehfoa{BLOCKED}.top/
• hxxp://gaohrhurhuhr{BLOCKED}.top/
• hxxp://gaghpaheiafh{BLOCKED}.top/
• hxxp://gaoehuoaoefh{BLOCKED}.top/
• hxxp://aegohaohuoru{BLOCKED}.top/
• hxxp://befaheaiudeu{BLOCKED}.top/
• hxxp://{BLOCKED}61.73/
• {URL in this list}/t.php?new=1
• {URL in this list}/t.php?on=1
• {URL in this list}/{increasing number from 1-8}

Beendet sich selbst, falls festgestellt wird, dass die Ausführung in einer virtuellen Umgebung erfolgt.

Es macht Folgendes:

• It terminates itself if any of the following is found running:
  • DLL
    • sbiedll.dll
    • sbiedllx.dll
    • wpespy.dll
    • dir_watch.dll
    • api_log.dll
    • dir_watch.dll
    • pstorec.dll
  • Process
    • vboxservice.exe
    • vboxtray.exe
    • vmtoolsd.exe
    • vmwaretray.exe
    • vmwareuser
    • vmsrvc.exe
    • vmusrvc.exe
    • prl_tools.exe
    • xenservice.exe
• It moves the files with the following extensions to the created directory:
  • .lnk
  • .vbs
  • .bat
  • .js
  • .scr
  • .com
  • .jse
  • .cmd
  • .pif
  • .jar
  • .dll
  • .vbe
• If it successfully connected to {URL}/{increasing number from 1-8} it would download and execute the following files:
  • %User Temp%\{random characters}.exe