WORM_QAKBOT.SS

This worm arrives by connecting affected removable drives to a system. It arrives by accessing affected shared networks. It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It drops copies of itself into network drives.

Arrival Details

This worm arrives by connecting affected removable drives to a system.

It arrives by accessing affected shared networks.

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This worm drops the following copies of itself into the affected system:

• %System Root%\Documents and Settings\All Users\Application Data\Microsoft\{random foldername}\{random filename}.exe

(Note: %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.)

It drops the following files:

• %System Root%\Documents and Settings\All Users\Application Data\Microsoft\{random foldername}\{random filename1}.dll
• %System Root%\Documents and Settings\All Users\Application Data\Microsoft\{random foldername}\{random filename2}.dll
• %System Root%\Documents and Settings\All Users\Application Data\Microsoft\{random foldername}\{random filename}.dll

(Note: %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.)

It creates the following folders:

• %System Root%\Documents and Settings\All Users\Application Data\Microsoft\{random foldername}

(Note: %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.)

Autostart Technique

This worm adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
{random characters} = "%System Root%\Documents and Settings\All Users\Application Data\Microsoft\{random foldername}\{random filename}.exe"

It modifies the following registry entries to ensure it automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
{legitimate application} = ""%System Root%\Documents and Settings\All Users\Application Data\Microsoft\{random foldername}\{random filename}.exe" /c {path and file name of legitimate application}"

(Note: The default value data of the said registry entry is {path and file name of legitimate application}.)

Propagation

This worm drops copies of itself into network drives.

Other Details

This worm connects to the following possibly malicious URL:

• {BLOCKED}34.75
• {BLOCKED}einformation.com
• {BLOCKED}terscentral.com
• {BLOCKED}nelboxmanager.com
• {BLOCKED}.co.in
• {BLOCKED}.in
• {BLOCKED}.in
• {BLOCKED}.in
• {BLOCKED}ver.com.ua
• {BLOCKED}e.info
• {BLOCKED}om.ua

NOTES:

Whenever a USB drive is plugged in, it randomly selects a file name in the drive and name its dropped copy as {malware file name}_{selected file name}.exe. If the drive is empty, it appends _Documents in its file name. For example, {malware_file name}_Documents.exe.