ACM_BURSTED

This description is based is a compiled analysis of several variants of ACM_BURSTED. Note that specific data such as file names and registry values may vary for each variant.

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. It may be downloaded by other malware/grayware/spyware from remote sites.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It may be downloaded by other malware/grayware/spyware from remote sites.

NOTES:

It locates the AutoCAD's current working folder. It drops the following copies of itself in all directories where AutoCAD drawing files are located:

• acad.lsp
• acadapp.lsp
• acadio.lsp
• acadappp.lsp

It undefines the following functions to make it unavailable for use:

• EXPLODE
• XREF
• XBIND

This AutoLISP script runs when an AutoCAD drawing file is loaded, allowing the malware that uses it to execute other malicious scripts. It searches for the file acad.mnl. If found, it copies itself to all .mnl files on the folder where acad.mnl is found. It then searches for the file, acad.exe. If found, it copies itself to all .lsp files on the subfolder support under the folder where the file acad.exe is found.

This script, however, needs the component malware file to perform its malicious routines.

It contains code that copies the contents of a file called logo.gif to acad.vlx. As a result, the malicious code is executed when AutoCAD software starts.

It checks the file ACAD.LSP contains the string acadiso. If not, it writes the following string to the said file: load acadaiso. When an AutoCAD drawing file is opened, this script is also executed.

Once a new drawing file is opened, the dropped copy is automatically loaded and executed.

The said action enables this malware to propagate through all drives.

This description is based is a compiled analysis of several variants of ACM_BURSTED. Note that specific data such as file names and registry values may vary for each variant.