WORM_SILLY.CSI

This worm arrives via removable drives. It may be dropped by other malware. It may be unknowingly downloaded by a user while visiting malicious websites.

It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

It opens a random port to allow a remote user to connect to the affected system. Once a successful connection is established, the remote user executes commands on the affected system. It executes commands from a remote malicious user, effectively compromising the affected system. It connects to a website to send and receive information.

Arrival Details

This worm arrives via removable drives.

It may be dropped by other malware.

It may be unknowingly downloaded by a user while visiting malicious websites.

Installation

This worm drops the following copies of itself into the affected system:

• %User Temp%\service.exe

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003.)

Autostart Technique

This worm adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Windows Update = %User Temp%\service.exe

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Run
Windows Services = service.exe

Propagation

This worm creates the following folders in all removable drives:

• BACKUP
• BACKUP\RESTORE

It drops the following copy(ies) of itself in all removable drives:

• BACKUP\RESTORE\driver.exe

It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

The said .INF file contains the following strings:

[autorun]
open=BACKUP\RESTORE\driver.exe
icon=%SystemRoot%\system32\SHELL32.dll,4
action=Abrir carpeta para ver archivos
shell\open=Open
shell\open\command=BACKUP\RESTORE\driver.exe
shell\open\default=1

Backdoor Routine

This worm joins any of the following IRC channel(s):

• ##8##

It opens a random port to allow a remote user to connect to the affected system. Once a successful connection is established, the remote user executes commands on the affected system.

It executes the following commands from a remote malicious user:

• Launch denial of service (DoS) attack
• Download an updated copy of itself or other malware
• Sniff network traffic
• Send messages using MSN, AIM, Triton
• Act as a SOCKS server
• Act as a SOCKS server
• Act as a SOCKS server
• Enumerate and kill processes
• Enumerate and kill threads
• Steal Protected Storage data
• Seed files
• Modify HOSTS file

It connects to the following websites to send and receive information:

• {BLOCKED}s.sin-ip.es