WORM_OTOIT.TN

This worm arrives via removable drives. It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

It executes commands from a remote malicious user, effectively compromising the affected system.

Arrival Details

This worm arrives via removable drives.

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This worm drops the following copies of itself into the affected system and executes them:

• %System%\csrcs.exe

(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.)

It drops the following files:

• %System%\autorun.inf

(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.)

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• 6E523163793968624
• 95A5756335A574A364C6
• Q9V1S45G64H79AF6G54B984FGBASASASAS

Autostart Technique

This worm adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\policies\
Explorer\Run
csrcs = "%System%\csrcs.exe"

It modifies the following registry entries to ensure it automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Winlogon
Shell = "Explorer.exe csrcs.exe"

(Note: The default value data of the said registry entry is Explorer.exe.)

Other System Modifications

This worm adds the following registry keys:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
DRM\amty

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\policies\
Explorer

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\policies\
Explorer\Run

It adds the following registry entries:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
DRM\amty
dreg = "{random}"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
DRM\amty
exp1 = "{random}"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
DRM\amty
fix = ""

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
DRM\amty
fix1 = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
DRM\amty
ilop = "1"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings
GlobalUserOffline = "0"

It modifies the following registry entries:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
Hidden = "2"

(Note: The default value data of the said registry entry is 1.)

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
ShowSuperHidden = "0"

(Note: The default value data of the said registry entry is 1.)

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
SuperHidden = "0"

(Note: The default value data of the said registry entry is 1.)

It creates the following registry entry(ies) to bypass Windows Firewall:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\AuthorizedApplications\
List
%System%\csrcs.exe = "%System%\csrcs.exe:*:Enabled:Windows Life Messenger"

Propagation

This worm drops the following copy(ies) of itself in all removable drives:

• {random filename}.exe

It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

The said .INF file contains the following strings:

;{garbage}
[AutoRun]
;{garbage}
open={random filename}.exe
;{garbage}
shell\open\Command={random filename}.exe
;{garbage}
shell\open\Default=1
;{garbage}
;{garbage}
shell\explore\Command={random filename}.exe
;{garbage}

Backdoor Routine

This worm executes the following commands from a remote malicious user:

• Download and execute Files
• Log keystrokes
• Manage files
• Manage open Windows
• Manage processes
• Manage registries
• Perform Denial of Service
• Perform remote shell
• Refresh IP
• Remove itself and clean autorun registry entries
• Set-up IRC bot
• Spread itself to all physical and removable drives
• Update, restart, terminate itself
• Get following information:
  • IP address
  • Language
  • Computer information
  • OS information
  • User information
  • Drive Information
  • MSN contacts

It connects to the following URL(s) to send and receive commands from a remote malicious user:

• http://{BLOCKED}t.{BLOCKED}s.com:6854/di.gif
• http://{BLOCKED}o.{BLOCKED}s.com:6854/yuyo.php
• http://{BLOCKED}u.{BLOCKED}p.jp:6854/di.gi
• http://{BLOCKED}k.{BLOCKED}n.ph:6854/di.gif
• http://{BLOCKED}k.{BLOCKED}n.ph:6854/yuyal.php
• http://{BLOCKED}n.{BLOCKED}z.hm:6854/di.gif
• http://{BLOCKED}e.{BLOCKED}r.tp:6854/di.gif

Other Details

This worm connects to the following URL(s) to get the affected system's IP address:

• http://checkip.{BLOCKED}s.org/?rnd1={random}rnd2={random}
• http://www.{BLOCKED}myip.com/?rnd1={random}rnd2={random}
• http://www.{BLOCKED}myip.com/automation/n09230945.asp