Worm.Win32.SIPHOST.A

This Worm arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It does not have any backdoor routine.

Arrival Details

This Worm arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Worm drops the following files:

• %User Startup%\powershell.lnk -> Targets %Application Data%\sihost.exe
• %Application Data%\myruntme.dll -> Copy of dll loaded by Malware to proceed with its intended routine
• {Removable Drive}:\myruntme.dll -> Copy of dll loaded by Malware to proceed with its intended routine

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It drops the following copies of itself into the affected system:

• %Application Data%\sihost.exe

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

Propagation

This Worm drops the following copy(ies) of itself in all removable drives:

• {Removable Drive}:\{Username} Photo.exe

Backdoor Routine

This Worm does not have any backdoor routine.

Rootkit Capabilities

This Worm does not have rootkit capabilities.

Download Routine

This Worm connects to the following website(s) to download and execute a malicious file:

• http://mmproject/{BLOCKED}dario.com/ntu.dat

It saves the files it downloads using the following names:

• %Application Data%\ntuser.dat

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

Information Theft

This Worm gathers the following data:

• {Computer Name}
• {User Name}

Other Details

This Worm checks for the presence of the following process(es):

• TCPVIEW - Sysinternals
• Process Monitor
• OLLYDBG
• PortmonClass
• gdkWindowTopLevel
• 18467-41

It does the following:

• Sends output of "ntuser.dat" as an attachment of the email
• The email contains the following information:
  To: : m.{BLOCKED}t@india.com
  Body:"Dear Sir/Madam,
  This is my mmp file."
  SMTP Server: smtp.{BLOCKED}.com
  Attachment: {Computer Name}-{User Name}-data.zip
• Checks for the presence of process with the following strings:
  VIRTUAL
  VMWARE
  VBOX

It checks if the following virtual machine- or sandbox-related registry keys are present in the affected system:

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Servoces\Disk
Enum = {0 or 1}

It does not exploit any vulnerability.

NOTES:

However, as of this writing, the said sites are inaccessible.