WORM_OTORUN.WRL

This worm arrives via removable drives. It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It drops copies of itself in all removable drives. It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

Arrival Details

This worm arrives via removable drives.

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This worm drops the following copies of itself into the affected system:

• %System Root%\OGa\RD\GOx.exe
• %Windows%\dllmgr.exe

(Note: %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.. %Windows% is the Windows folder, which is usually C:\Windows or C:\WINNT.)

It drops the following non-malicious file:

• %System Root%\OGa\RD\DesKTop.ini

(Note: %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.)

It creates the following folders:

• %System Root%\OGa
• %System Root%\OGa\RD

(Note: %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.)

It injects itself into the following processes as part of its memory residency routine:

• explorer.exe

Autostart Technique

This worm adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Active Setup\Installed Components\{random CLSID}
StubPath = "%System Root%\OGa\RD\GOx.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Windows Dll Management Service = "dllmgr.exe"

Propagation

This worm creates the following folders in all removable drives:

• OGa

It drops copies of itself in all removable drives.

It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

The said .INF file contains the following strings:

[autorun]
open=OGa\RD\GOx.exe
;ªÓÈÅÌÌüÏÐÅÎüÄÅÆÁÕÌԝ‘

;Fuck U Motha Fucka I Could have been ur Dad but the man who fucked ur mom had more change than me.
action=Open folder to view files
shell\open=Open
shell\open\command=OGa\RD\GOx.exe
shell\open\default=1

Backdoor Routine

This worm connects to any of the following IRC server(s):

• sik.{BLOCKED}nix.net
• idem0.{BLOCKED}k.eu
• ogardf.{BLOCKED}ils.net
• ogardf.{BLOCKED}rk.biz

NOTES:

It executes the following commands from a remote malicious user:

• connect to URLs to download files/updated copy of itself
• create process
• join channels
• kill threads
• propagate itself via instant messaging applications such as AIM, MSN Messenger, and Triton

Rootkit Capabilities

This worm does not have rootkit capabilities.

Information Theft

This worm does not have any information-stealing capability.