WORM_FLASHBOT.A

This worm arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It uses Windows Task Scheduler to create a scheduled task that executes the dropped copy.

It executes commands from a remote malicious user, effectively compromising the affected system.

As of this writing, the said sites are inaccessible.

Arrival Details

This worm arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This worm drops the following copies of itself into the affected system and executes them:

• %Application Data%\{random}.exe

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.)

It drops the following files:

• %Windows%\Tasks\FlashDrv.job - Task scheduler

(Note: %Windows% is the Windows folder, which is usually C:\Windows.)

It uses Windows Task Scheduler to create a scheduled task that executes the dropped copy.

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• iwqfhqowrfj9483urh8yfhwd9qh8qfhryhuvnkvu4h8w43rh34whf83qfh4389hf893

Autostart Technique

The scheduled task executes the malware every:

• User logon

Other System Modifications

This worm adds the following registry keys:

HKEY_CURRENT_USER\syscheck

It adds the following registry entries:

HKEY_CURRENT_USER\syscheck
Checked = "1"

Propagation

This worm drops the following copy(ies) of itself in all removable drives:

• {drive letter}:\RCX{random value}.tmp
• {drive letter}:\RCX{random value}.exe

Backdoor Routine

This worm executes the following commands from a remote malicious user:

• Receives parameters to be used to execute the downloaded file
• Delete and/or copy itself to arbitrary directories

It connects to the following URL(s) to send and receive commands from a remote malicious user:

• http://{BLOCKED}o.co.za/admin/st.php

It posts the following information to its command and control (C&C) server:

• Infection log/status

Download Routine

This worm connects to the following website(s) to download and execute a malicious file:

• http://{BLOCKED}o.co.za/admin/1.exe

It saves the files it downloads using the following names:

• %User Temp%\fdg{random}.tmp.exe

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.)

As of this writing, the said sites are inaccessible.

NOTES:

This backdoor then searches for files and folders in the removable drives then creates a copy of itself as {file or folder name}.exe.

It then sets the attribute of the original file or folder to Read-Only, Hidden and System and attempts to use the same icon to trick users that they are opening the legitimate file or folder.