WORM_GOLROTED.W

March 04, 2015
 Analysis by: Miguel Carlo Ang
 ALIASES:

Win32:Malware-gen(Avast);Trojan.MSIL.Inject.bkjb(Kaspersky);BackDoor-FCJT!70CDC035B76B(McAfee)

 PLATFORM:

Windows

 OVERALL RISK RATING:
 DAMAGE POTENTIAL:
 DISTRIBUTION POTENTIAL:
 REPORTED INFECTION:
 INFORMATION EXPOSURE:

  • Threat Type: Worm

  • Destructiveness: No

  • Encrypted:

  • In the wild: Yes

  OVERVIEW

This worm drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

  TECHNICAL DETAILS

File Size:

1,253,888 bytes

File Type:

EXE

Memory Resident:

No

Initial Samples Received Date:

04 Mar 2015

Installation

This worm drops the following copies of itself into the affected system:

  • %Application Data%\WindowsUpdate.exe

(Note: %Application Data% is the Application Data folder, where it usually is C:\Documents and Settings\{user name}\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Roaming on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

It drops the following files:

  • %Application Data%\pidloc.txt
  • %Application Data%\pid.txt

(Note: %Application Data% is the Application Data folder, where it usually is C:\Documents and Settings\{user name}\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Roaming on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

Autostart Technique

This worm adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Windows Update = %Application Data%\WindowsUpdate.exe

Propagation

This worm drops the following copy(ies) of itself in all removable drives:

  • {drive letter}:\Sys.exe

It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

Other Details

This worm connects to the following URL(s) to get the affected system's IP address:

  • http://whatismyipaddress.com

It connects to the following possibly malicious URL:

  • http://{BLOCKED}.{BLOCKED}.212.64/WebPanel/log.php